Gozi Malware Detector

This Zeek packages detects Gozi banking malware activity.

Resources:

The RAR files this package looks for were discussed in the following articles:

In addition, the long base64 encoded URLs are also detected by this package.

You can find Gozi activity with the following command on Zeek's TSV logs, too:

find /logs -name "http*" | parallel -j 10 zcat {} :::: - | zeek-cut host uri | awk -F '\t' '$2 ~ /\/(stilak|cook|vnc)(32|64)\.rar$/ || ($2 ~ /^\/\w+\/([a-zA-Z0-9\/]|_\/?2\/?F|_\/?2\/?B|_\/?0\/?A|_\/?0\/?D){200,}\.[a-zA-Z0-9]+$/ && gsub(/\//, "/", $2) > 10)'

PCAPs

PCAP Source: https://malware-traffic-analysis.net/2023/07/12/index.html

Example Logs:

gozi.log Example:

#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	gozi
#open	2023-07-24-19-00-13
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	http_method	payload
#types	time	string	addr	port	addr	port	string	string
1689201023.169002	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/8jvrTb2D/c4CxLmogLgZQGC_2FQ_2B2b/Ma3ylmhq8i/MeT_2Fmtq1zDpHZZQ/2OknTIetuvPf/SqlzkcwbzWM/aFx0b70stnXODu/WDQ2wUhiUaYRbirzPbAvc/2V_2Feb1BeDPQaU0/WZs_2FbMUKJ37c4/Gf5YYgB_2B8BS7mcYa/jECotoj7R/7bH1bkdIXbwbqpU0Nryv/_2BfEwnTZ0On333QjdJ/fdFWYGQpQofXObilmWG0P_/2BS5YP7Tcj18X/cQoSxxb6/FYqDyT3sva2N6amcI32HXsv/n6pffb_2FO/UxvFILD91uIk2oNQx/DEmgyRV_2FLi/3pF67pmCpVP/mFnn0G63A1Sv9N/05KeIqFG3zHYuPPOU/1P.pct
1689201024.619787	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/IfjXSAQlkk/LWNR4tkuOMiXdy5H_/2F55TZ5Ulkmf/KZSJQNnlKNL/oXNw6o8qzjnHJh/42iAsB5AuQ8n_2FyMP9YN/iAK5Z4rM1kiabXH3/Tbf6F39oZk8a8mY/9CVAQTHkAlTev6Vstr/ir_2FniSr/BvZGpW5mVB5nr9pTRisy/xPxWcp7jW1doRbtDMhT/9qJZuk9sdFnLKTsj12Ald9/3B3TYfDuu18i7/7LNZfim3/7nt5T5HqNSKfJKcDB7vJpeR/BoPpPolfrA/Z_2F56SDXpQJw4TYJ/45pcw80raC9d/yeDiXFQDftm/RIxazSR_2BPJ0F/wL6l8KasDC6CAzVNLSL_2/F535_2BDNH1/tcGkkEMCZrS/i.pct
1689201025.545122	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	GET	/uploaded/MsY1SyBRpp3LKx93fMeITx/w33QoEW7tSfHh/8_2Fqcx1/mAOJzt3teF4AUCrc8IBMkbm/8laKdMc_2F/A0s_2B6tfYEvyAcP_/2Bk_2Buvkjcq/80G4xrhnFAN/TCW76WZrbPDSMY/_2FhKbl7f8pmHGBET0Y_2/BvcMUzja7B7xdYYK/qwpg5fbrMu6AsJ8/Dejh0cXcFfYe8h75Yx/Fn3LZFhMy/29bQzFKZyZHoHgfyV1XJ/Lw1D14ehZUiPYfQxTWv/LlBNcxqMhthgso7PYl8tLq/JhO8H_2FKdEez/1uHkLyhp/SD1X5u0VHgJvzUkDhpUUhKb/Q6cyGyHP3A/UPnKN8bJKuY7qHpRC/r94GeIuEWP3a/G9Zo2.pct
1689201032.086164	C4J4Th3PJpwUYZZ6gc	10.7.12.121	49800	151.248.117.244	80	GET	/uploaded/DjeJ0blPQ/_2BkfrDEoFQgD04wO2F7/Ojqqobto35jEVZ1IQyU/G7zu4_2BFUfhIMJcKkibbg/fjjRaEElICvmR/e5DoJnsG/vsx3T8eOiuXp0AlWknwttvf/A_2FrNprrb/bHnMsv4916Q0BUf_2/B3XIECBmUK_2/FW3G5XPXaPV/ySf6P_2BIXQe7C/q0IvZNIlHZt2c8lCjnMGY/BP81zPWMMzAUn3VS/Y_2BCg7CLJsM0vz/MloZ0Th38yNZOadE6L/qwrs9PKza/13Lw9jqWnbyh08rIXwcG/mMM0HdBwcj6NPi6_2FH/5qnQe2GM1T/ZuHEvxYT/j.pmg
1689201032.792223	CtPZjS20MLrsMUOJi2	10.7.12.121	49801	91.199.147.95	80	GET	/vnc32.rar
1689201033.823106	CtPZjS20MLrsMUOJi2	10.7.12.121	49801	91.199.147.95	80	GET	/vnc64.rar
1689201045.338855	C4J4Th3PJpwUYZZ6gc	10.7.12.121	49800	151.248.117.244	80	POST	/uploaded/3lFSQwjxUfg8HgrTtqSS/ZKopMRdt0Jtv6ehOunO/ppBgdtF3YUX5Co9W0vX2OQ/UNZWu2BHmWHLi/4Pta3IUW/h8js8gl66mR4P51kp_2B1rV/l_2BDjFJoW/DhHjLJGFTtgPfY5qz/0jnqt8GbX_2F/M2R1QPMjPhA/1LDVR2FItKJXdJ/1qIKPwGyBNh80d_2BqfF_/2F6OR9A8MzQ8A1Mu/qqkL0hlaa4U4qkx/TrAV_2BpGP_2B6FnQc/TZAppMESi/SnlO5AU6khpDGRiOveBi/R4uVGlbArQZk3cDBamb/rekwL.dib
1689201092.103798	C37jN32gN3y3AZzyf6	10.7.12.121	49804	151.248.117.244	80	GET	/uploaded/2bzPCygywLAsZWyvNxjbcR/cKuODU9uu8UJj/gDXKcy4d/pxB9zipofP8_2BeS_2BpJud/wkj0W_2BrO/D0paOzWNgyCiXYNe9/AsQMoH_2BRJg/GVsPSdgJRiE/zITTWUchGJIQxc/PZZSjCwXGLw7S5vL91vcA/oe3B5CUOEdkQKGto/2ktXW4RVt_2Fmbv/n4_2FHRpBrdDPlZiJh/KmaIFjefC/fI1TDKY_2Fi19DEaFCtf/tbJcxt2An0A0fA6gNH1/boadLZ34ffeu1q1ucG9FKH/EYecNdYZoQk50/PveWZCeq/k53trqCUnPKJ1m5xUDc0yho/XZNF99CD9fsHQ2/HTO0Ek.pmg
1689201102.721168	C37jN32gN3y3AZzyf6	10.7.12.121	49804	151.248.117.244	80	POST	/uploaded/FjEF3XKaILeAQXFS7ZA/6ce9M8T8314qcvkufQ9O3S/JEiYn7jw1hdk_/2FAtv4Vn/N5GtGAMF_2FYvtXXK_2F4Zl/0Y5qJKSmBu/44at7WoJqMtrEfLU4/cCeZclRfpCKD/aqpRqtgj2sE/drWQE_2FO8cplq/lY0zN1yBj_2B61heqRGGa/5HcIhc_2FvLTthv2/zJpeMsgvDci4AdQ/JdEAEDTa1bhGI6VaRH/rQTuBAqF4/MKUC3UIYW2SYFTHwfKtZ/tqpLYYZ1oSbrStWcuxS/OOYuTMB0uaGg4_2Bq0zpwn/Gww.dib
1689201152.062519	CtxTCR2Yer0FR1tIBg	10.7.12.121	49809	151.248.117.244	80	GET	/uploaded/Wbfe_2B11dG116Ncm/nQpZ3IruCPSM/3Lj73LAhcds/M336HbpbJFjPEL/ZgkdjdFIqBCjLtdnX14jQ/pQ5Bv86GIP5te5wH/8b4izrx5O9qiGfp/GRUC2Np0poTRCDkKkc/F1E4cQ1R6/lwssUMXdU1nBa8LCS0k_/2BId7kfbrkQVYBR50Dx/zW_2Bmfzi9fE7K8N9p4LoV/xI2jj2pDdJhUG/_2FG3di0/_2BhPTAOji4t57Awbk_2BoP/FD_2FSdzzj/Oy86TrwY_2BeLaoSb/T3HHtuhn_2Fe/V7LWds_2FAh/JDMBWxJ2ws7_2B/H3SE1djM5W2vA05PIQhD2/cANoEAshNec/AshCNLFh.pmg
1689201152.931165	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/vnc32.rar
1689201154.267014	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/vnc64.rar
1689201212.075480	CqlVyW1YwZ15RhTBc4	10.7.12.121	49812	151.248.117.244	80	GET	/uploaded/2wXajjUK6yQe/Hf4yISpkavj/9iz17_2FpADpqe/FWDEQXEZFDkmT425JjzHt/yyAY_2FjOXJCcbQn/Uawx_2FYMnhoXhg/ibKz0SNEJa5T9jTj3f/6NOt_2Fa5/Ku8TE_2FdlXWmtildKLG/gZiwSpWV6ZG600H5kL3/fgOUNq4SopgajW6DchSOfD/ouyx1xA5AWRmw/H_2FnmjS/_2BFOQbTGn_2FGrFa8mb4aT/1gPcElQ69l/HjKo4TfTciPYAtacn/mMNHAQmFl5oI/k_2BpMEeXvn/EvX7gGlJyfJbja/AEj9oZdnWgTa24IDPHMcK/D_2B7fNjNY3qwhg_/2Bfk_2BexEKG8fb/_2B2V6tJ/Z.pmg
1689201212.545740	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/stilak32.rar
1689201213.629452	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/stilak64.rar
1689201224.113946	CqlVyW1YwZ15RhTBc4	10.7.12.121	49812	151.248.117.244	80	POST	/uploaded/WXSLx9k_2B82HoW2/5_2BLUFBQld8l5T/qSTWooG_2FxVNQE46u/lEUybYtwS/COcE2tivLeuVegwAhJog/faALYpov_2FC8h5u5eO/fw3u8FebEwLjC7EtSs56sq/jeBDFyP8S3aoD/khK6K1bI/hFYNrfXYtNkDgime9sa_2Bf/PexBAh2LNK/x9DDabFXM4vy1FqMl/hiJw0kWrjo17/_2BEcPVh7np/NrWpuoNVXSAumZ/w5HpM98Gc8U_2Fd9mwtWQ/JslZMqJLjs5A2cHb/dPTxBByvm2dlxKs/QZAx0q5BQy/yyQ.dib
1689201272.155278	CLNN1k2QMum1aexUK7	10.7.12.121	49813	151.248.117.244	80	GET	/uploaded/NpXONA6eXmuef0TniOWSt/sbrGBURPDr67_2B9/zugzDGAY9vrWyYE/EoCvKEsas2Wm6zMwGW/cMs90msiF/gnFvn30lzjaZ5h3PdKID/6g64fT4mJRE6B4R9WUT/HKA7lMal5mey_2FPlSOLtm/XhNIsdZRWX2jS/kdCbahFx/NR1EtG6hX9iAZdhHNUXacNX/flRI_2FocO/5pJ6z880JnKjeUa00/au7MK4OJL0GY/Z3ksfmVR9IV/r3UCP3HGpLy_2F/xc5XMCSKRsk8WSBjGbRqu/PGOO7SV5Onm8JPaO/a5E2tVpUMNRT_2B/7iu1sJ94FgCmULIGUx/2xJ8pAqlA/YJI.pmg
1689201272.641361	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/cook32.rar
1689201273.697406	CpmdRlaUoJLN3uIRa	10.7.12.121	49810	91.199.147.95	80	GET	/cook64.rar
1689201284.289498	CLNN1k2QMum1aexUK7	10.7.12.121	49813	151.248.117.244	80	POST	/uploaded/OAoLm55_2B2OCF/rEWUf7X9OOkiz59zPQg3E/Aj5owhhIbmbWgx54/UV8kPJrYxDAnkrg/OKPbChY4KRO7PEjk_2/B43R3ufTu/uvyMeJAMJmrlIBLpmBfP/L4v_2FB_2BBaG4ladWq/3aMpm2yqqMZXZu3jf_2FVA/VTO_2FUe28w3t/tFzcTS3R/xc7hl9jMM_2BB_2BDIlMD_2/BqSLR5qL96/eKD0WGu5ydPqFhYg_/2BXCIyssztxU/cq9urrcafTw/mSgYrRpEyTyV0z/jbJLU8aVKuIk3v9MuxmYJ/_2B60trr/CQBxcRJ_2B/c.dib
1689201341.330163	CiyBAq1bBLNaTiTAc	10.7.12.121	49814	151.248.117.244	80	GET	/uploaded/7chaPmanW7OMxzoNzJHScgR/EHmxsmATVa/jTfmCcJ6135be0wkb/Hg9peWe_2FuD/DggTpUxGdAt/a_2Bgx78GlYrfc/oijiGdGd1d8ljosgBQQti/4TwXqFBIUG941OT2/VKCQX023FLHkcvB/1b1mWR2MFml0MzW54N/ENj7AuThp/zdzvrxl2cpTy7sAtXYGN/FABQ17R4mAyxhHDee1G/1y87US30E6nykjpjJWy5b_/2BNhvSOgcLNRS/gmeCK_2F/_2FStMa4HGsB_2Bc5R6IDNr/rcWw1GvShf/DGf_2BhMmSqTsvWDQ/iJGrX9Z6avCeA/Iy.pmg
1689201401.111510	CFSwNi4CNGxcuffo49	10.7.12.121	49815	151.248.117.244	80	GET	/uploaded/mRR3ORUROz39SoV/kiuTm74UutfgKYebxd/JE0VsGbtl/FF_2FmqGwCsLZy9eITrT/xTXT62bIKB_2BC9DEAY/CSZpMZBa8F_2BclDzuWuwZ/O6tAPYB2YbMBh/_2Be1LOd/EugZwzSjHCJLuIpbjSoR8YY/yJSG6Ewddp/30U00WqhCrcqsk6dc/YDD9_2Bnq7rO/_2BxFUH7dWq/It2prNYWCwhd7F/GOyp2LLeQ830NYx30vBuf/zYFSTa_2B3rEzKAI/OOhWZWW7qqLxz_2/BuDv4VIIcQHeeZIcpF/T2QOy1us1/xA22L6mNqa_2BTVFLQdQ/dunDhPL.pmg
1689201531.196852	CeP1sc28dOzbbYkbA	10.7.12.121	49833	151.248.117.244	80	GET	/uploaded/4VH1_2BzC7iRDDuEVthHWF/T3JSy6qbVPy_2/FcxxBrzO/W2Iky3KhV8YQrXr5YRzbJEz/GO9RtgA1bO/qhQc_2FMOXteECcw6/vWWHW7JQBSwW/ul0l7PAjgnf/llfjMB28NkBB3V/lX8f2SEjVNDsqOlTPW_2B/zGlu6s5vQAi5IjzO/uafedv6VSqXOY0D/WN0xeikImEZYHbbrgt/isDoKhZFg/13AuYkgug_2Br2kqRea0/vymlhsYQJ2B9gwxiKiS/DI2qSZ_2BpqCYeKa_2F4M3/YX_2B_2FWjfO8/UvADHYMP/SNtuVtLd06aaqLuJZrFp1oa/4S352KiclF/1sdrGNLK_/2BfwsMU.pmg
1689201591.194845	C5pL731XEkARXOq253	10.7.12.121	49836	151.248.117.244	80	GET	/uploaded/naUgoPbUY3O/qoV_2FwC_2F_2F/OELJzK5YH_2B6Y6oWK9VN/7juhNslM90yKsuua/z0NOnI57M_2FKwG/is6UchtmWobMY_2FFQ/CbXg2zqMI/rkNt82Dzrh3mSAfFfPu9/vmOQHcPh_2Bv6IANIXi/n_2FV8msYpQsYtQ6k0RCUw/oruJL2xW0f591/N3DUEkEe/qJo2U6Ayeau4RCjDiIw99yF/wLSwM13LdN/jDG3JnDQz5IhhQelV/kmO1s2ugBljU/AqLY1J8FB7L/_2BOU_2FLVHLrw/VzS5f7QPtvxfr9UgeU7xw/U343Ur_2FAozVwgG/PTvwHwan/ZlW.pmg
1689201651.177386	CB0Ovs3cNZgLQ93FSh	10.7.12.121	49837	151.248.117.244	80	GET	/uploaded/zSkAr0RValzexVcPEO/H5sZ7fWu4/Vk_2FjiDgQJTAtg57AFq/w1CnttfSRSoHtIvcTJI/xcA_2BfWwXjsEOe4pkpBcw/0FsrL_2BgJ0gP/n0r1z8fe/gTZepja6JAtOyIvV6KEX4mR/bWFwMtvD_2/B5fyMyKL9rogrDXRG/IquYXAydntz8/_2FsvLjhTHY/CD3xRr0CUzRNjc/xsJ24KnKUm1329vVRVjjd/Tq_2BEhg3y7TBXTT/bn8DxQ4vtNsyYOq/FgmjsjHbMV4rKHYfJG/SV_2Fwytq/dDaCrVLtvAu3zrr96Ng5/JY2UgWuYHzc722Ajfmz/G6LzB8OE3bckX5/xmrspg.pmg
1689201711.211343	CbI5Qt4rlFnOHuL522	10.7.12.121	49841	151.248.117.244	80	GET	/uploaded/U_2FBgUCf/oTcVoziJTQrSVxNVcI_2/FojBZ1XLXFkH_2FJ4pz/R_2BrGyZxHHlEh0zQsrpqh/VAhkJhocUIj9S/Cxp8Dyp6/G3_2FtQ04LGKT0AocYmeXbH/7MTivwFtHm/ZIVCAFVY_2BmEx30t/4OcpL3AkQrru/g_2FNG_2BxA/h1g3bUC7lxnPxE/a_2FncXx1ZXQu_2F5tWgA/swynstaitAhZAVcY/CbKYUvuHVW_2FrH/A1QKKgJZkcX4WD8yhm/zpT2Qvz5t/gzEn_2FC3qpsa7i2z6zw/tD6APN9JjRnNtlIDJ_2/FoKmIb3LwF0I19EAJLIybX/Cy9g3cGaioXj4/dwXp5hbs/VKNFBGl.pmg
1689201771.252226	C9Mb033HGlhETKxUbj	10.7.12.121	49847	151.248.117.244	80	GET	/uploaded/iQmIGg88Sx_2FiZC257PJ/0E4Koq9yQDXVTVD_/2F8Zpg1emokEyFX/3ArNidRMgLbwPWPh4T/BzJEQt38f/gWl_2BusWPA4L6dbBK1y/teuf5fuZc8pvnmQRZdI/BUpqbjjmY4WXZBMHn_2Bf9/O0qwCN0XoF8hB/GtMxwrx0/JvfHz6i39Lbk4QOeggVWNC_/2BJtz0YEr2/qL2iCBm_2FM0U_2FR/AS2o2m3W_2Fz/hwMZ8n3WBht/1fDxbr0LXiJ0bE/gNtBmzIdnKIUqqZDpDPTW/g6zw3ZtAACSZIGOR/WhxTHPh25vDyLWC/iKbkcpJNZ_2BwQkcNU/3fF0fyq7koPy1suTV/M7T.pmg
1689201901.251417	CsLUyBLEs5x3GKtgk	10.7.12.121	49852	151.248.117.244	80	GET	/uploaded/EdOQc23Tqki_2FZ2J/OPIRgW21fNKp/oRfxEzFPDOg/zxYsgTjVTbioqZ/SOCTi3mGMT_2FJWeyH7aE/h_2FklY8K8ZBcWiF/C2Ncvz85ayPz2XU/az_2F44HqZUKh6HBYN/0R1i3b_2F/mRcTA26Yy2pY6GGMS8Nh/XjDxTUFIgrDAtE3Pot6/8PGOJ3ZLEKYR6gle3i5l_2/BQYte_2B8_2FL/UjJ6So85/Sk1Qc2aju8_2FZb2Iy5bg7k/RGDA8XhJOd/eJCZ_2F91ydM_2FPB/wDigXMDR_2Bq/LKoRsKLOYrN/fFDj4dfKr6GX6i/eAhghqYoNIYgi9jAOpWPJ/gYq1xsZhRsu_2Fa1CatMg/YS.pmg
1689201941.128287	CFTS591Wnlb7gnrpP7	10.7.12.121	49857	151.248.117.244	80	POST	/uploaded/Vv6RlhAJqr8Xu7/kFVNjpa1jutK999_2Bcdo/AiyDAbKlkLy5mrlc/leV2ruK_2BEVvpG/ldTlpBQGWkv3LlV2d6/VK_2FW8LY/T82G5srZgZ55c7SvRL9a/X2Ds_2FhcN6HzcRMQBu/7mpis2RNJyJvdeQ8YqDBRX/S6jbQjIXJKiWw/Szu93DbZ/W55zx5TNzWbyPO6vugaG9FZ/N0bh_2BEJu/M3Oyjoi5W8cuIbF_2/Fsg6LuwRhPzd/MTitGYWORYS/O5DhVn4daIVrWX/0r23_2F2rxUupamS_2F5F/3dBAqoJF/Hb5.dib
1689201961.040235	CFTS591Wnlb7gnrpP7	10.7.12.121	49857	151.248.117.244	80	GET	/uploaded/37PbehohXNJC/LU5yRpOzp9M/ROgF3YsTK0kqHX/p6N42E5UMSwIuORKmDlIb/rCM_2FWUFgXyp8_2/FKVT89rivKghkze/9XEtwytV5v4v9A_2FH/DFgtQ2RWZ/EtxJHJua9yF6AYmqZQNE/wUgSTMX0bQcoAaHXcfu/p0NZpAz1eFb_2FIDzyKgOa/tOnSiEInCW45f/Jk_2FmHo/yC5rMJQiliRDVVrzi_2BR4q/_2F4gOwKOx/VNaddsRC_2B40RAT4/knXfQIqBJpY5/_2Ftg8v21Ns/KMrOVEU4_2BT_2/BHbhNg8NYMWbQcyZRyvNk/0_2Bnbs2VlXT_2Fx/5f5IZO9ivHc_2BU/WhKgpJ9S/vj_2B.pmg
1689201971.511714	CFTS591Wnlb7gnrpP7	10.7.12.121	49857	151.248.117.244	80	POST	/uploaded/stEss_2BxWF8w_2/F0jBmKJAz_2BdXjNET/U85peQmuX/ZWOgTM3J6QNraNWOo29K/ytBAh47_2Fjmjn5Vb9y/ngSDksnr75rONzredi1JsO/yXDLcHQsSMa_2/FLC0j5C_/2F1QUUz3Aj_2F2k9G4JNtUc/iQLBH4EQHD/rxUc2k0DQLDbNhAkw/_2F5ZtvTWGm3/HluQMtJTMLQ/KOQfV1ceE58TKM/VHJjPGuO_2F9_2BNaJoEP/KxOSQJc0KrKcN6_2/FPfPvcEcsrTYJiF/IL19AlBdqyJBiarw4F/gil0z1QZg/N3OBEqL3itMy5tEoxlsv/bJhPkUGe/lYS.dib
1689202021.300337	C2qZRm2yQg9RoQNkVg	10.7.12.121	49862	151.248.117.244	80	GET	/uploaded/1qZknqIx73fqjpr3ZW1PY/7dujj3wR71WELOBm/89hKedDFc_2BlqL/eWe7lfuTKyul4quhN2/kop6nI0UJ/r1JJZ6AnpoI_2BsLZkeB/YoPRdjm1sxAD4Er8afr/IOqToHrPZkGWyGEBt6b0wP/M1cPEqtA98XOl/XVYU6jUL/TF1aOMuaN_2B_2F0isLpXyq/sW_2FLvOHC/LQL_2FThf2wo5MukL/E3wtuNGyEOlI/MnsYahmQ5_2/BExvlYXH61CuAr/VXOx9k_2FHBlrXIV1wvZg/CQuuMOB033N5AmjO/ie2c7sA3EbE5ZbN/xhWBLBIFugl4Qe9Rr9/hxc4iaAD6/h4S9oeka/a.pmg
1689202031.776444	C2qZRm2yQg9RoQNkVg	10.7.12.121	49862	151.248.117.244	80	POST	/uploaded/BubCr3koX/POZduyTH_2BeanfimI3S/gfIzNzfVpfMWE_2FPsk/voXb9ARW0wnL2mIFdQmVJv/L5cqtb_2FvR12/Ujp51m9u/nnGPM_2BU1ycCu_2BqXookk/TLjL1kW63r/ut672sucPsxC_2FCx/VtGCowTIYNDj/vdjzhYF45e8/QYoZDt03rvBVeT/mksxBWrHGwJqZUAsDSbfo/O_2FDGCcVo7hehg6/onhVUi9qC1_2Faf/9Ob7z0Er0AkWBtroIP/L9cZ0hevC/cveV2kJskN2p15bY8cnH/_2B2UF_2FrtRqaPeIw9/qK_2F_2BoSKdKjsSD_2FWY/2iISYQo.dib
1689202151.256582	CQ7b0y4Vd4NVQ3nJRi	10.7.12.121	49873	151.248.117.244	80	GET	/uploaded/AxUsY2BmqWaHisOvYdWU4/9LkvD3NAjRH3mO9T/9qz_2BlwSOMRLhj/ijnXGTviLdPzJmugVg/IbO_2B3Wi/trTsTRYy0Jz_2FxI4bmP/jAfTAjVEXhXMZAFA0oP/W91bqr2ITkRN9WjYtSIsVW/GFASJI_2BYTw6/OmJCfNsM/BfCMn9_2BZxQrwLwGIw2VAZ/Ppi6gdKF5M/tN0ZmpFM_2Fyz0MoE/l5EGw9jSvW5w/_2BCmn9IWlf/Hr2Ng_2FdusmpO/_2Fu75E4_2FMXD1rKrX_2/FhZX58E7qUwutTFi/WZaAmUmlDGzClRn/uuSrgL8JDEsCQXwM56/oBi_2FDdN/pSaKY8uX/UwF1nOn2_/2B.pmg
1689202211.296833	CsnMLaDyNeIqxq6i2	10.7.12.121	49877	151.248.117.244	80	GET	/uploaded/j175ku4IgKWqAexz/eNzwpJ_2FDNkAL_/2B3mT0OL2b22eTVAyX/De8CSCpch/RuQs3IbxbKF3YfwcsXpR/IbWU_2FsFG4ignnPsq5/N8Kc4ZnadV4_2ButwiDp0N/V5HXn1dBkylDN/O5erv1bZ/wtxLg4G0tJQzRgVxVSHJFMW/pLgA_2Blri/Jpc9Z5dgoTtYZ_2F3/SIrwXAtrggVe/L2sAALD8xBt/QHjzeWh275jnz_/2FZZox4zQbmNeC1i1EUBR/Gw7wiAQhpE98eqXa/bl_2FABIGmk2Ho4/cbe4IRZkDnE4a4m_2F/HZQ3jsmI2/0_2FdajmS7lh6qZvgSBi/fpSXfEnSSz8/aqe.pmg
1689202271.307407	CL7JR54e4lOc3aUAph	10.7.12.121	49885	151.248.117.244	80	GET	/uploaded/t8UqiM3v1m1LC_2Bhn9G/hV8YIVh229rl_2BpjAc/9O3oBI_2FE9kLlEqAPYdpY/XpDqHpbzyNcyp/pzetA0s7/1S56g0HsjbZahS8CR0nqguX/TCZYyXTFU_/2BHUdsMkYDA6kXJmg/7Kzhdaka1Ll7/gNz6BWAbz1K/208frbl_2BBBtk/yXQ4WrNABGTnhPDvFOENH/0rpGNGhTDwcHeImk/L3QcW5c_2FHqqG9/HMMHsFylqeCdrKbrue/wfDdXq9qv/9pe4MEGLpgesIPr0LK8k/wyYvbHUP7YNJpRRG8Bz/iJRDPyTLinoAxFdsUrGmUZ/hkiWx7oAzfMHd/cxqeq5_2/BJCt.pmg
1689202401.339230	CA4o9G1CB2Af4WWhCf	10.7.12.121	49906	151.248.117.244	80	GET	/uploaded/DxFMQWbparDP/Fp_2B20H38c/dCIxI2m1VNeQet/9hHfjU2viXLC4RJAgrPnP/2y2GnJ3b6BY2hzEc/F_2FfVLPVXEIsBV/2V7ysyKmLG2fS8t5CH/Fclv_2FFF/3CyMisUpBbsh73ERWfYo/rTD0jKQTjd_2Fe4ZQ9M/xIlOTqKfw7_2BR_2BmXn95/SDDOqQXKBucMS/eSjdtK1p/nA5RoVzJ4K_2FUW_2FWtpOF/iBhZsCnr8q/XVtwsQABzU7GUB74i/lzQORziJsZjR/DyeOmdop1_2/BiEd6NpHxBwvMA/SpzzUQHOElU0eGyXok7h6/516JrWldK/Tx.pmg
1689202411.921705	CA4o9G1CB2Af4WWhCf	10.7.12.121	49906	151.248.117.244	80	POST	/uploaded/3py5_2ByZ_2FW31LxU4bo/XHb0XaonJa2JSwZ0/_2Fa0vPcjCaxdj_/2BKNWTliXRcADewfjD/K506wpDRn/7VBUBhKiHEaa_2F8OJwV/CykBe2aE7hsd4VTwQzG/60nP8E4_2FxfhQhFlw5K6L/vw2CJd3vOIjsB/0ActnX60/Pb6CzeL8YmqWIaSpz3OHkCw/HwBH5en48i/IVidCom_2Fqf3QDUy/pvDZ11YLIY6T/qywofGc_2BN/3rTAKdso2E7r_2/BplXR5loYwAyrWypxOmg_/2FBOlPtQFvzb4p2R/bXC73GkhbLegqR2/nbslVwDnBFkEz3/lFGmR.dib
1689202461.401924	Cx1J5T2RlUHdnWX4P7	10.7.12.121	49920	151.248.117.244	80	GET	/uploaded/1hzCOBFj_2FdP_2/B35W6JvnQAymASJDj8/D40QyMAuH/rmJlzG1_2F9V_2FRKKCo/n6nckv3dRoaf6xvLE9l/HUz5tBUTOWYy9nezn1w7Qf/e4Kl8Xdm5MpK2/z5CVmQbX/P39frcKnksiLYMtys6mqLxI/XrIRsoaZ_2/BpU_2BdIq8Y4vwbOJ/SIgTkX4eD42N/cAmwVuosanQ/nCAV_2B6_2F9_2/F_2Fb2OondhjgpmeUQfbX/xy_2Bisn1cxZDI_2/FQaauedG3a5Bbrg/77_2BxkZ7nQw7pjOu3/MmRH9owwm/CLxAtnJkoahJbDWbdyeJ/27P08whTZxu_2FRvh0E/UOWCG7I9_2/FaFMnMU9/07J.pmg
1689202471.908952	Cx1J5T2RlUHdnWX4P7	10.7.12.121	49920	151.248.117.244	80	POST	/uploaded/ySJLUZpRvEE4ikAUDAOCoj/vvOd41idgMtHr/j_2FLYSV/adOyxnO4UTDOP6WBnSKSqYY/yeMxy75nJx/REsjO3YcBXgYTXIL6/27W4ayBzGJ0u/Fet8_2B0qlk/QZgvV42uHag9DN/is_2BIAiC1_2B033V_2Bf/YtCnKkVrfLmzFfpR/v_2FrkDga9W_2FE/R_2FsVt7feoMUTim1N/xxEz6YE4M/WJ69dgsfuAPd1i9d9JJP/XmoPzoIiHVn2KF944_2/BvnkbSSDlU1y_2FYskLqPa/5yO5r8MHtn6xR/BIfIQsLC/Aa2Z9DPd8TATiHYqvSkS3z1/N5tPZ.dib
1689202521.409328	CXmENaHXj6AAZ6z67	10.7.12.121	49935	151.248.117.244	80	GET	/uploaded/2AVEiPKVVrW_/2FD_2FBmRiQ/AllwJdQY8KQiQS/cty8Q_2BqbS9gHllwllmo/wDGZrv23uy82Swpe/maRztG25bLNwllm/yBz5hnAz9Vr2_2FNmi/Ig5vd9mzn/JpT7JDnpRrdkbYbz28LJ/vnqckKluj12fLiYg_2F/fu0C_2BSOzylx_2BrqZi4R/vIHXp7BkPC11L/uxaHOW0b/BNDwol5HLIOtesku4DUfgPG/PQql9bzQXZ/j162mHRr641xmG6zi/SAgWvNga8r88/03DEwaexCX_/2FZyWMIKpvwJD_/2BME2gnvD5Ctly4Awq9QY/1_2FPRxAyxYWzCk6/LKX4pKQDjoEv3/KtmWc.pmg
1689202652.484868	C4mAqd3q1os6WQrFGi	10.7.12.121	49981	151.248.117.244	80	GET	/uploaded/E9naUqW02f_2FV/8CpY_2F5evb5tnXrsadX8/GWgT1j6MNrpBsJWg/R_2BICAxzTwGomT/lH2gup_2FpFploiEAH/1cCeN3uro/sgcZIh_2FdJbJpAtAapV/kDaYsvHxPxzLshepjVU/QvgJ98JZcyy9BddRpXSew9/3uCdfhPDlalqz/ox4qQaXH/YOC5ppIgMOgNfjNYpFS4MDt/bbAFdWRbJI/I0YToad1QrcjgKQse/UqNYipBLaeau/GoTPP1QfZaX/zpn437Aan82WHX/kTBRAGyOjcRiV_2FbQ_2B/HikMVXY6rcYK1ZcP/vuwggxRcb1fnl71/_2BR5EqyEObX/mdRNjxDfd/P.pmg
1689202711.569398	CrtbM81EwribjjBbs6	10.7.12.121	49994	151.248.117.244	80	GET	/uploaded/t6eEuwOKxJp66Mp4SlUgu/nbJy7_2B56TadA7Y/9pKSMdGnx6EZtzW/SeTIIhFAe96Y_2FaKG/Tu16NtqLn/QUJb1w98GX_2FIszMKLN/1mVcGjfOUamsO2EcQLL/UPyxUcod8ZqZ41_2F5Ahp_/2BY3c_2B8OomL/_2B9nOVw/wCe3WUjt2USJSD4c6KmvjvU/OUuZWL9jEt/Cu_2B5mxjqM4qANOT/bkYqUBQ_2Fwv/dkr53VABVzU/2kTptAmXCHU7ab/ewAJ2HmMXh8I5TyV9tPED/NHggn1wiy0gfbfkf/k7FQunl8TUNFHy0/X0NvQneh0HCs04SUag/JN0jY1kA9vdw7_2FD/gkdVu.pmg
1689202771.576861	CjvpgV6kqW0852q3f	10.7.12.121	50006	151.248.117.244	80	GET	/uploaded/mXl1G_2BLuT/ulVWag11hdBggM/75vI9noQ58TLJqJ6SU11S/HYxlqPj7ioi2BfPw/Xg17EelKCFHehhR/ANLPfUrOrZyl_2Bs_2/BtO3E_2FC/xOW_2BHe8iC7OJFeb0Dq/XDw1q2aIGdYSyWuo57m/EiTRwpZjknM7LUcP_2F171/0tdqpSaDw9SDP/t3xDxOmf/th_2Bvm_2FCkaOJyin5YWvD/FM4nm8HO6Z/_2FnKpH5PcrDddmhb/RI4sCV2QJWTy/b31knjiyL_2/B1zZTGZDdfBEjI/3bK7_2BDtimrWxMTOd7Uj/Be4IWMcQmArNs_2B/x9cWwiP_2BeodZC/tFR60aCBy5Nsp0_2Fqoub/nN.pmg
1689202911.519514	CQnxI03CHdqwafO4o2	10.7.12.121	50033	151.248.117.244	80	GET	/uploaded/idpeGC_2B0/2kQf1uT4uZ79Pr7n8/WF6sT_2FGVto/YwweamUG8w9/73dt0HlqpAjbf0/9YUQisX6CP_2FCc3pjWrx/rUk3_2BVGqyM_2Bz/sXEYx_2FGgBhzu_/2FR3Jwmkof6AuOUy13/d1Z_2BedC/Dt317mP8KSHqGYmNGR6H/J6F9LJu3_2B0gSidHcS/uhhsJnmdwLU7Ejf2Ek9aHq/CuQsmVvWuJoJ2/dqV2_2F2/GFa120xd4MN2OsMtOu03Ph6/LYsXcnhzAg/S_2Bg3_2FExitUEp0/d6kBQUdqzehO/wcGJpv2kNAi/Kekz_2B8vlY6B_/2Fd3HtNj5t2XXFzi4pqvy/tbzcZhq7pnb92M/H.pmg
1689202972.515558	CaIW4B1CNbhrY3Z9P5	10.7.12.121	50045	151.248.117.244	80	GET	/uploaded/tGaPOl_2/F6Mh2dZ_2BUvpLhjHF8nzqI/lhHIA87HKq/Saz6QHX24CpPkTRIZ/CHTHQx6MLrsh/bJqT9dQMlFv/g_2BiW_2BoHW1N/aZp_2FOKvtSEPf4usApEz/DYAd9jcbajBy7vKD/iTSNuZ5_2Fth10W/1gS3bvwzziXm_2BzUu/VwEFTW7Fn/_2FgR17GnUYN42GIj6_2/FzH4ZcUngomfxg8G62i/Z_2BbZBSd5aGZnE9ZDt65S/Sz4ywc7Z_2B9k/k5454JYI/XQyeRZaPqIMvA07Dq3JBp_2/B31jP_2FqM/J52UxdJj1NTETljHI/ekz3IfYvDeDc/BLClVN1EDIu/EtxNv473gV/wS8B20N.pmg
1689203031.548183	Cgjcpf4p7v2QzNmLSf	10.7.12.121	50057	151.248.117.244	80	GET	/uploaded/Xxnqt8QTWNyYKZ3Ofl_2FlQ/2cqgy_2Bt2/bu5FxIQmyiJA4F5zA/m5L9MUDsIZQ5/vaklkfkT_2B/RnRmXcZ2wIBwBQ/DuEh57O7sqY3lC1BoVqZ0/KrIq9qQkTP7WRCH1/rskumalmsn3bS4L/VpA4v3v8F4LVWLJo8B/HJ7yI7_2B/qpoLP5xyaIhiyFkuC6y1/unedsL1LqFDfGHLxGP0/x_2BLAnUt0gyiV2hfcRC7V/9Npzj39q9Y4s_/2B2y4Hdd/pmg_2ByI5OpcYb6_2B4dIfu/WuaxCdEZ_2/FZaJbBamtj_2BpeDp/0FFqZXQlLoXZ/HYEMHBzNA13/iR6dckn_2F/qLiS0gwU/noj.pmg
1689203091.582848	CyyAsI1bENRZJHsPxi	10.7.12.121	50070	151.248.117.244	80	GET	/uploaded/_2BabLbGUhMmUwTE7l3/wSj_2Betj4BkhLWkxBelTO/ly1BdJ3lI3ofe/Ay7upO10/bowFGc7I_2BpI8a5qDvzIRJ/IrMHsFrXP_/2FdGtj0oyFyyIs_2B/1YaMJHU3tUNc/Pgz2LBg_2BB/vcwuYnJQkSL4Bo/g2Gav4K2mA4lJY_2FaHAp/tej1x2dl5Y6bG6de/UFpMC2OdT_2BLt8/M35DroMJbMZXYyxqZT/CTigBO_2F/SzmhXn5z5j5Y92KZk8Rg/Q5zrX7oyaxEUiy4_2FG/tDwo9XmolohyLW1imUFeoo/zH69RLdapS9AO/SryToPI1/BE52j22QgAHUZG6N3nIEKuY/7ECHDK_2/B.pmg
1689203102.112429	CyyAsI1bENRZJHsPxi	10.7.12.121	50070	151.248.117.244	80	POST	/uploaded/ddeCT3KwMh0di/NQMOh6zt/Na_2B5J1PsURAYhxj61P9w_/2BIg7oAz8N/9fhTbfaG30Uf2A_2F/UUnrjN1VUBXL/3xQnIAsuoun/13BbJnk6gSTGdU/zwB5ClknZRey21tqbAk7m/zxHNNaaf12zDQ6q2/N3SIEaCn6vq9gvs/qqxMYb6_2BhRNBNA91/UzUcanwAo/ODE2bhaOb6Mqd0_2FN8D/QcTvaFcdaUJDRljhm0_/2Bs8_2BHoEZNCPk_2FnVA_/2FSZJV8AqZIyo/7IfylBw9/3onTyfAp4_2B_2BqyWShENS/XV784oes.dib
1689203254.132488	Cx2fdd4vASV4hGNamk	10.7.12.121	50112	151.248.117.244	80	POST	/uploaded/k6bIbFG2_2FnYGmlYsT/vg5fySWbG_2FhQZ4DPg7aJ/AKvBHVcBV_2B2/DfJdhOm4/XSDF8PIqOmsGtgkm_2BiDqZ/8gVHpiF0wA/GkYQrEZGlzrOGJuGE/b5r4mdbb_2FO/bupfeGN17Mn/dWSmb8FLIdtj9Z/nrBdnhXbjiIBnTsX3KVxI/5IReGoiLFHPhm8Ew/FxT0LP2bAoH4TuE/wKTIqAYVEC0EexGC_2/FgtNNMZfU/27B8fmocVCmm_2FUAGFx/jBxp21AbHr7gwY3Hk8X/y8A7vVqX0_2BkdiHcf0O98/KMRGq.dib
1689203254.651561	Cx2fdd4vASV4hGNamk	10.7.12.121	50112	151.248.117.244	80	POST	/uploaded/SZKkKgJcB/sJoB65rVSMeXCIrOcrQM/QOANADtweDY5QEHjzLq/HfdvUnLJHUH9_2B4yhIfPI/Iz1icqBtymEjz/ipaqChUs/kV8sy14FmNsXm3PuRxwo8gU/0lN8TqYt0e/IXPB_2BoYrewhIIJ4/nMPoT3auUoUN/z_2BSX8kbJj/PRVBw0zwKRymy0/KqDEwypxOcRhp2N6_2F_2/BMVEfwYiNJrH7khG/jvAfK0AODIGmZO9/1vdiUtnHL2vh3s7l_2/BCwwjaYy7/58CdXZV9ToRgNkqsSNL2/YV72Zpvg/OxTEO.dib
1689203291.647790	C6RIBPCLUqy7QrkG7	10.7.12.121	50120	151.248.117.244	80	POST	/uploaded/30CtPX_2Fvw4PACZKEc8/qyFl6Oc8mTMylv8gyK7/WnRZT0ism8PN1GEc9_2BG_/2BAfKvB9AvzlO/EO0vmXi_/2BOoH8_2Bb0xVO4Y8xS6ZOM/9gKDuWiJ2A/AjTE46lOHW1dmycPM/bpgNOKA2TvYh/Xmml_2BQXyU/E_2BOglsmha_2B/KUdZ5wmHSTxMmwgcUKPkG/1mSDj6O_2FA0WWtv/pv_2FbBDWQTbyIy/aZynW70YNHfgM4vAp1/RkQb2tmwt/ckDG6z_2BLm8kkotAEXo/ecT0_2BBFqm_2Bs4aqq/uR2aTBuaLQQP40Hxsqa4Py/1BQhZkQ5XDqcW/JAs.dib
1689203362.487843	Cx2o7z1ve2pwRELwm2	10.7.12.121	50134	151.248.117.244	80	GET	/uploaded/ZxLksknNk6ivM48uDfa/_2FPXr1Ncfu_2FOzEt2TZq/foikZetDEH1Et/uh2lpHOX/ANwzetBKv9A27aLvX3hwsJE/Enh5RaWueL/AnrYDboNz44jj5I1G/3s8kk7i2M0Ig/OhT7MAj_2Fp/FqiBVxJpchgWvC/ReXQUwZ2BvXWqwcxhJlnC/RV7sK5JLFeu0zNOw/AnpUe4S0DVXBp8t/cR_2BYbKIM153of54L/pyygIIlTS/WRp_2FWNMMSEiZRD_2FQ/jTOS2WA3ekHC4xePxpD/aznYN9nAgMbcETjfjrfobv/6Z1vUsIcSLBY5/A60S90sX/TKpSjbtofeKTRDJ_2B6Y5Tx/E.pmg
1689203422.481132	C913kM1HJAW0Z0QCWc	10.7.12.121	50147	151.248.117.244	80	GET	/uploaded/SxqUaUpfZ9ZaaO4/5hngBcR_2FJnEotE7S/eSqZGMOOk/oW8WOWUKqDheVDe_2Fse/u2lmT4j5e2JhwSaPRgm/87_2FL8_2Ba7JyXhLZhWxF/vdc0iCOnccqE8/sjHGsRRH/9oEZDWIQC3FyMCJWnHc6jNG/gYQIKHd9PU/DPswhqf_2FWoY2CLI/rKOv1zB1l1uS/0sqCRmt9DPP/fp30_2FGZzmHi7/_2Ffd1xB9INGQI2CzDwT_/2Bgf_2FySycE_2B1/QywrvLQ_2BVLfq_/2BNMmPuYgzs9ZgBSu8/2440wuEeI/Cl_2BCxeWUf9MqhBjyCp/JG7aEWxZTk_2Be5WsUe/nnLoyYc_2/BChty78ls/vz3.pmg
1689203482.554689	CNeOYwF6hHL1iYy7a	10.7.12.121	50159	151.248.117.244	80	GET	/uploaded/HO21UQkuYtulv/RaLzOT1g/z7LwvwBLeTCG6zJfG3ih5Ul/iHJugqcShO/w05gUeT_2BgXOTeP_/2FYzoC1A1QH1/K_2FsdwpiDv/yYJY_2BAxq0DqE/ulXeD4_2FGwKNP_2BNSzk/i_2BmjRd33yLUNOb/YKMRE13tNmilShI/9mtU8bjKwjEQ2JFugB/dG_2B80AI/C30H2uBRU86UgE62vkk7/cKocyetTXejXxfrps2K/efevA2DRZ8o24ZVzOjCNGC/wlDIapjkNKaKK/WFg_2F41/W3fu59Mm9RUAUkDP8A2c6e_/2BckVJVnPz/vt1mr1shdLV4bfrzs/ancxITSil/vKc6miMid/_2F4V.pmg
1689203493.176660	CNeOYwF6hHL1iYy7a	10.7.12.121	50159	151.248.117.244	80	POST	/uploaded/A_2B_2FzxlyxQ5Yc/93oOi5QuUZYG73J/0Dcuhmo1HbwXKvK7MO/bhspZo_2F/VZpdoKOVcamkycqnEbEk/uWyjPgFj0IRkGBNB5Pu/FJjmVAXshT2mI9v7Vt29x8/2ZbX_2B_2BpSe/a9JQMMJZ/u8VXzuTwwCjMhYpM_2BFtJT/ScczXLWR5s/Oi3yRgjs7y_2BECzT/wGvbG5PnNhrg/XoBJ2lO9mJo/XXtEKi3KIJ1PQR/doAVcorqycBT87ue3Yaa8/_2F1iYr_2BQKrPTT/5ieqYos_2BFohTm/uUpRq72OQZJ3UTGiCg/gmZ1H7uNT/T05BPuTKKqP/YW.dib
1689203682.900923	CgPOxw4ZcDNtb4qUGb	10.7.12.121	50199	151.248.117.244	80	POST	/uploaded/29EdRJpCo_/2Ft9n6Dh7FUNbAKbK/99xM5FKfTyPQ/BAtUpRkb23o/gz4I7ytTxxwqCi/YB1qxshixgp2nNpxRypxK/2hMJfRfhln_2Ftnr/4TZJcgHMnZFrVIl/n83Fl_2Fwg5oWELK9j/T_2BJV_2B/8WOmAyvy2yKOMf9cdgDr/DUkUsaX7tsDic_2FGb6/qoqJxytaMgWyU6BWEMjoWI/CgDkIMGCdU4oB/O36vBklf/BRT_2B9cmamIqfEdj_2BzVc/4k3sq67n0t/JUseCT0ti1arACxWJ/DZeZBIdhHQf_2F5p6sd/Tq.dib
1689203683.775329	Cr2WN61qD7lqnpZNrd	10.7.12.121	50200	151.248.117.244	80	GET	/uploaded/efqDcj4iQ2lv48xGKtltOf5/UqFaJSrnfF/Iac70F90fE_2B8b_2/BUGeYClUxYAo/McuAIHzVcr4/XfWSPEnDQ1a3h3/XDTr8qljxRApZtPWLvLeY/mFLC_2Fs9PVXwAdj/njlG9ejiQ2aojpS/nbP_2B4A29ku3pA6Vu/_2BaRFXTv/YTKs5GU1rVR1_2BGaWI4/LpvHqQH4LapabtbMuar/YWnCohHi4ja2UcpYHg7aW2/TTzQPNPN1_2FN/wfKNJwz5/RZNtwdSBID_2Fdj_2BRqp_2/FJCHyU_2Fu/jJLBI_2BP0XvX71Ec/ecj9XvozSxbU/fVtn76Tq9JK/8ecpWRQrW_2FH0/CsXzwngTz/2U.pmg
1689203743.782278	CZTcLz2NmHcn4ZD5cc	10.7.12.121	50212	151.248.117.244	80	GET	/uploaded/B1NtGB_2Bg7rhFFmrWMnXP6/cKspudfeP2/hwvO91nnGp59QQcSq/rc_2B6VPc_2B/ggbp_2Ft5L9/zz4xgWTbuRMINb/IUoa4KK4GF77mlEyhDWCA/U95Su0yz4yE0NUJD/Hs6d0jwDuT83OGu/GQPh0pBxYsmfScwshR/xCv3VAjqW/U3P7nrr2ZhIDdHe7zV6N/le1eDM2BVY0wDqPV_2B/0bpF5HcH7gLwk_2FoKyoRu/c9C3SqZi_2Flk/6ZD7a_2F/sBwFFB1vaozDWVziXZsLMdl/hJ8LzRZU_2/F0HqnbDrFe8gwCPkv/RvKUTf3hoYsC/2wmwtJVIfHM/I5hKlsar/15rG8wjF/A.pmg
1689203873.832265	CaqiRv1kssCwKFiAEi	10.7.12.121	50237	151.248.117.244	80	GET	/uploaded/dPdJcBhm11UPdUT/VKf43UY30tXRa5EJLw/_2BpMYoYv/2uD5OgIhTGG3cJNXt4cI/7qKszZA3RlWiMdPw7_2/FJaQ1C2YpxBfwlKf2zjD8e/b3cbZk1Mg_2Ba/eTZLPr_2/F1PXaxDyfNEkSZ0lYPeH3_2/F9J43HKJe5/dkvZ99giseLnXnaRW/NeCOiUZ8b39I/peWhBeQgc_2/FUgQuGX5LcoXOW/yfppwOeMm9nKwUgwgC8d0/PhX5QouTw5pqm8HD/nJei6yjqXZCoHSj/3JCT_2BIVLBP0GbUU7/usHdkJipi/oFP6S8zLik139gi9U_2B/daGuzC3W7x6vi1Qih4C/db0cjJv.pmg
1689203933.839532	CkSzRz17ol01kBjlNf	10.7.12.121	50249	151.248.117.244	80	GET	/uploaded/umWwdp_2FdWe9yWRAM6L0/LacFR0deQaZf_2Fb/Nx_2FGtUQSuc4oo/HdFuuTStmT_2F_2Fuo/Il9kvARsB/CSYyYhoBuZzZ8E4lc5hK/vvjqR_2BMaiUsEGbRhO/yQxFTaa1sim70jVo7O29I4/SxZrn186RrKe_/2FDzQmj1/0fMF19UOTbdXuW7VIo_2BMo/haTgJldl_2/B17DF6JBGBO3W6k5x/gfB6FlqQOWUZ/py1AOBSZOTz/WJXEZrLLJH7kKB/JLuchj6hoaN8mn3eKqQMo/x3kmgavW0t5Qsy1M/5C0T67eYGzGPEhK/Hsku0CMgrVfqEMlpYU/fKGb8Jsx_/2BUNX2b_2BwFN/t1.pmg
1689203993.747292	CbEhxC3seucNFjJzl7	10.7.12.121	50261	151.248.117.244	80	GET	/uploaded/7WN0kJ4boXmaZIdd/pXv65Lj9uonPnDU/CCfbH9ZRSnen97t7fL/0ojIHsCGj/7OTP9uPtmfNcHnwyGJuV/ooxSxwVbyavu8Y8i6BQ/mqU3pCeb7WTXZO_2BKu8Ly/83roiC55IT5Gj/0FlZOJl3/MIl1rqSD0u6_2FVlbzlj4_2/F_2B9EGpKb/XC6L7PrqeHwu55U14/KYtC373eU1Wa/MWaJBb6Nolp/W_2BQ3_2FCQeVU/_2FG9_2F8UEBod2RAepT8/RaO3aZcSnCOAnWhR/mrGSthW9iQEi6xf/ENitNYMTionWMEqGj_/2BFw8zUHV/jKmoYH6bZGRZY5C2tRd1/_2BlgB9j4gkem/F.pmg
1689204053.789030	CRJy7L2YDZXsYxDhC3	10.7.12.121	50273	151.248.117.244	80	GET	/uploaded/TknlQPebsQL_2Fn/4bQWqAMjJ4dyP7CR7n/4C5_2BY6G/2Z44QflqxNJA4gsDbaqM/4f05DthZC7maqkuCxWj/GR9gv26f9Lmmj7FL4byVI0/1pNTS84ikZLB0/RXnlZDHd/Zx_2BzpWqC2wNuJ1c9dGFCC/G6kK01EpeA/sU_2B8ckV2AiEIgha/_2FLy6vyPv2P/R2UMougfcY3/RxWbruzdRudvfv/_2B65kOrM8QER43rYOeFW/rsnnYUr9zIMJD6VK/jjXMgS8ewu6Puw4/i3PMA4l_2B_2BA0m_2/BAFrbSY_2/BKt4q_2FVeEeyS5VgGnw/R82wVo0oDn56SONboeQ/fsmUAKmM/6RYpF.pmg
1689204183.821089	CC1mwWtpL7QIsnIu	10.7.12.121	50302	151.248.117.244	80	GET	/uploaded/p8RaWACnInKXTLdHvErZz7/J7H6e6MMAj7Qc/FKznMx1z/oWiS_2FibrIa8Xuewr2NPM5/Ue7eliV8bb/lNKxliTux_2FZHtvg/Ejxu1fEGthCA/SEBhbPhX7MU/gDSG3wtZm0d6h_/2Bzerhb3egjpWXY53oFrp/TseNMt2956wfcFTb/naKxt9A3mHpbfQ7/nX2bbAigixTGF73rdM/7h5jj4r_2/B2RpJ0Jvuy6bpoPgkwUW/ZAyn2w9xZfyCaGCh3sW/anwW_2F2dev6oTI1OUDuCu/4_2Bz_2FqWHvJ/Yc347dy1/g2kte7_2BRW5aDU8qLcFE1w/rWgBXcJNQQ/dAi7P52Px/3In.pmg
1689204243.802027	ChUf2j8A2cckuCB9c	10.7.12.121	50314	151.248.117.244	80	GET	/uploaded/iy6FgXKzkEIAsRVHQr/rK6APaghL/GabIQIJ_2BbhOgPyTr08/qmhnXZ_2F515E_2Bj_2/BWP16hhJEgLpz1R6IxPt8I/H7Mk4s4Gmx3Cu/6yjYXx15/0VPT5GcFzPhqrgzN0tI7624/8nSufyILVG/QSHkyUXs9tBJXauYC/rMZhMDLIRe8j/4MADS8rZ6y4/AMoE9g9vkUeRZs/w_2BF78RCIPPRRyAUqmwp/QY78hM9vvJIF9ZTo/lVkNINdcI32LV9S/dlxaRxjGqZA_2Bv4Px/_2FxQnZjg/2PU8eUprNwlg1KWxoZ1X/JlbFQ9lOCJk3pRCadVQ/Xu5ZWDyz36fklV/l6IM2R.pmg
1689204303.918463	CwK86z3GfLlLdBtjf7	10.7.12.121	50326	151.248.117.244	80	GET	/uploaded/P_2BwwDuI/YmEQvvKTEY2yDXNTNNkj/HTnSroDGC0Qfja7U9Cj/2I1WTH5m_2B_2B2qW98zc7/yvGfoFc9AoO0A/BzgJq2uq/tXlPwDlqp_2BRkW3b1WpBe5/ZsEF3iUfIV/F8ZI5kUnOqTDXdlg_/2FeqHn7A0MV9/Drh_2BpmhcA/zDBzd3kSqtZqFC/vZ2oEtAzIkzs3MEm4L6Ia/0sfmu_2FjHlzRvbC/3wxqzqtT_2F_2FY/hBBa4BLU_2BcBLpcOK/ErunefaDe/MsiHasi5EPBI9wrU63Sh/QA6xya9e0oa2_2FUzBl/e28yag0LL_2Bimce3W_2Fe/HxSe6sMISiju_/2FDlODYH/hnIYYm2z/p.pmg
1689204433.867771	CDbHurHHYzQh16a75	10.7.12.121	50353	151.248.117.244	80	GET	/uploaded/QaBT9h989do7tpLbZEa9/uqKmPLfdxi235Ip197J/Zc0oX6Nu_2BHxqSl9naSN1/qi0a5_2FsrOjO/bfUb7s5_/2BrYwHEAv4nbStTkHBWnct_/2Bcxz6y_2B/4OkBMErb4HzxtYP_2/Fy2VE3HmzOJU/Sb_2BreCruz/lJDTBXfOMAL8q8/cVLI69SUs2Ev9qizvOoJN/q3V7jjK3eMUFlEGr/_2F5xG6ZsCXfbsj/Xj2zTCmPMeFbnnl40o/AQAHPe4kw/Kx1iCQzVtys_2BLuqXx_/2FcTXtAP_2FpcTgK2EU/vlcEXyiUZEM1d4huYL2f6F/GtvhHJFhDWO7r/f7f9Gu7qHK_2FYLntPN0/kR.pmg
1689204493.872035	Cdnacw1CFnnqrlU3O4	10.7.12.121	50365	151.248.117.244	80	GET	/uploaded/SFU8NJ3QwJXIacfIMo/nT46ItEND/R_2F5oTdYRsMhGkdYTDn/pN1Rr9QVP5aHQ1B29_2/BudiUzQ9bIHNEWxJ7fFKfB/aRyQZQ5SsJMHN/fRL2glir/J91WnmpUUQg5GtZlUJbfx9l/Cs_2BEMqPH/vwqiRUfOApLE6kV6B/szFCzrxU2Xf_/2FFjtaki0_2/BLxwhAyg0phhDH/SNJQoLj3eKzZhr2lK3QeL/nFZMWzUVjABmysUj/yQaHsWhN_2B1jxq/7jWTTuBxXuiuisn8D6/QP1egtIOd/37q16rHDeJyDTABSeSf9/pOMBL8jpWF_2BL8N_2B/8nogoVCU_2BBHVoDbuPeN6/V1.pmg
1689204553.840066	CEAWkJ28DI9nEKRfOj	10.7.12.121	50378	151.248.117.244	80	GET	/uploaded/u1uzP7T2I/i7w4Hd9cLyDxjZjKa6Ca/KwxamL52UIo292iIXih/E2DXLEVGhV5RhBOoPTSWq3/R_2BxLC7DspJL/7yi_2FWr/iveLLQz0Tbc0X_2B9iq3qKL/6G2F6OCxON/3BMDetSDjfaYh7gHc/DxRFXA9sN5U2/Kg_2BGX9qyy/yVvfqY4l5O2PVr/FwfFYdwvxv15gLbdeXlay/wm20J1d7OnhTXHr3/GU4TMFC6mcH_2Ba/f2z2uAuW55uHpPaK7J/eaj8w2pWP/1LyRQBm1_2BgMtPKnY3R/ypqvyH1DtQU_2Bze_2F/zKSxlrczQQsIvV2kRlLIMA/17ZG1mst_2FVUxQN_2F/4ct.pmg
1689204683.938169	CilF4d1b6woayAE906	10.7.12.121	50413	151.248.117.244	80	GET	/uploaded/bc1bm932Gi8AkB7CMdoi/dV6NGeXlcWdoFbsJnFC/FQZnIx7u0wQZs8gXewgk2O/_2BqEL_2F5vUH/VjpcgRrm/NgFQBF4d0ml2qUjPnz05CNh/WBeUsAyX8h/DYU_2Be6ioc_2FA9o/bkBn4zKxTE1N/1SebIT_2BB2/5hdp86s2tIvCxD/tZmUgcI6tODvZKdoJyys1/e4sK8m7GZS45MABe/ErGNCS3Es2MiUbX/8g2aKSm8DCj6uNwDbP/RnZ8rlx9a/lrUNLg4HRLMm6ysR4pwf/VtZBd5aLMF2Q_2FrqZr/qT7tLbEkySOgW4gIG9cEFr/b3tW5AqoOLBZY/_2FK4oG1/WJk_2B.pmg
1689204744.043980	CmlD1G1PBWF7V3AqC4	10.7.12.121	50425	151.248.117.244	80	GET	/uploaded/J7AyMDoOHNtPv/F61d6RF4/sgoNeiU_2F1Q3lkK1tsf8sx/76dNvSBc5l/1GHenh7_2F_2BUHj8/XpCexwUALidO/B6oCTOIaDCp/BGBC2mbK23zDfB/G1ve_2FyrAv0YFfxUd8rG/Nrg7n75rtGz4qTLc/zwtYm4U525UUeia/XR3HrESx5Mm6BePFvr/WYJKT7WSt/UOx0Er6yDZWb1oUrK4cy/3lxI1BiqAYu1m5Zawj3/rzPcZUOfx_2BQzYvT8FEi0/lAOpQLoUltA46/nJ7S_2Bl/4h33XN7qCwXsPCL75oCQiX8/zuMwy7RZVJ/uzCWoIvLDVcW_2FKg/0Zvm5TaOKVk/ndN3.pmg
1689204804.049881	CeAngf2WowKEx9bxt4	10.7.12.121	50440	151.248.117.244	80	GET	/uploaded/j0V92elN4AgiJh/TfB8_2Fk5Pb66NwYJzNkT/WO98G_2ByoTV3ZBn/7oi2zmvppgJaBkS/p8THYiS4oYHoPuHonL/jeW2tp33l/1qb6tUr4FcKUnc53keCh/Od8h7X151E99bGiamiE/80dDtojDJrP3nMczndSDbN/hurD2u3Wvgkmz/gf_2BsTe/ONuEP1hYNaGpj0XME7tQi6R/JiLUxwB1yT/W0cIPyMuDH_2FT61q/PmJB0478uQ2F/3haHWEzlDT9/nRS_2BQWfkELeu/3Q_2Byt3wlxUAcEgnaLMq/P_2BQ1o4Vl9TeDSG/sskZMV1hZhh/1Fl.pmg
1689204863.953154	Cu5n8i1eR1Uq7cpNp8	10.7.12.121	50452	151.248.117.244	80	GET	/uploaded/wzSxPKhYb3/amGaUjIe79iB2uCIQ/UV0lB8L1iULz/1JTCK6LsoFS/pB_2FUpFzxAeQN/P93p_2BPCbZHI3DanFQag/KuesKEvUpnuF3qje/8NSGg5GnP8IfqcE/pL4PmUmbpHdluilkWj/6SSE6kLxU/J_2BpdNPha0Tk52iTZth/QIb_2BeZ8hbup_2FX6_/2Bpr0Cx_2BS6UQeE4yN8gv/O0SgRU_2BKqr9/ADErRv11/ooaK132xLBDAfUkTwyJQpfD/DFHltxNB47/H1k6O0UjuVbIYJScH/4n05WxQXAP7K/dB_2FqEOh4n/F9QJSJPUlD2Ext/1RVp4n_2FTS8_2F_2FTUO/NnkHwmoDh/eU.pmg
1689204994.006585	Cvez3u2SD3arHlyAhb	10.7.12.121	50477	151.248.117.244	80	GET	/uploaded/zcq0mouRZbsEBuwI/1ZVtuoLkBQIkDBb/20Pup_2BZZSwUK_2B4/auyUtHMT7/47LWasbwYDovojd7kJEn/FgbBKC2ypvroGuwDxDd/_2Fx_2BGn_2BkKSde7AQ5C/zqL7qCwfOEfLl/zrUC5tf3/Sz6bh8mnaQbL_2BzGWkYGPX/T8CLMvgnYA/qpAn_2BHhX6DAd5wA/2X5_2BhN3fHc/brwc36k1UAv/HGeyh3XrX6l5MY/e8Sf8nA1VjwUNrQBrKkV1/BqySqtvQUKlSWlaJ/NZBBU3as7mhsKyM/eCKzefGLEaQtLIlYmW/imY2UfvXO/m_2BWO3gBz0Yrr64uEoR/ltS1yl4YwwU_2/B.pmg
1689205054.117709	CGOfGiDKJQjG94tMd	10.7.12.121	50489	151.248.117.244	80	GET	/uploaded/30FDJL_2FDCJZSD/0MgRkD_2BEbM7VmQyC/YQRB_2BaE/b9Qjw_2FZAI_2FhWTQsZ/yjt1j8fcKnSIGGxssm_/2BAmYd2SJ6MCHYPusPeG8U/WbhOYhvO7GMme/qQPCIW2m/XWFLvNmV0GK_2BWdiG2jaf4/pL08LeHCP4/l0UUKYrN2soixKWfZ/RR0yBNBET5Lu/WhnyiVDEJae/P_2FJxANXcNgQd/rMoxlV37_2FfyCRb0HfvA/2SHQNXUBGJuNiKFj/XqB9_2B_2Fl_2B3/ySedrTPVeYxoaEmY3j/se5vWo5jA/jiYbB2IXJDPO2hF3n6cX/GK7T_2Bpwxt6_2BBdVD/jLuvRYs6ALcQs/ioDLaE.pmg
1689205114.096666	C8KI9R1ifxBOWmcYbk	10.7.12.121	50502	151.248.117.244	80	GET	/uploaded/5mKEQVfE1Hlb7gcoveeNo/RaChOPagVb0qwlkb/SLef_2BKSGBQ2ud/vrGrhQOZsTZeNtjh_2/FrUE4tpng/C4ZxRu5_2Bu_2BrTw1QE/11yoYLfHSYstbdW_2F_/2BDHZ1JYPhtBbfRpzHXfsD/_2Bokc87PgeVU/8l3JsulR/LDTldCWQ7EAuGbc2EXcDb9P/Q_2FuX4GOs/l2fLVLF_2BqQv1fSA/kl56xJ_2Ba1U/9PVx8uaCvMj/tJXqqMtoNm_2BX/_2B7Cij2vNlyqPgM8S_2B/jjWeKzFIw8_2BYp_/2BDnn8R_2BH4OgF/wukJk0_2Fp2quMvSc_/2Frkevv6Q/l4WT1Nk8HjuweZK1o_2B/qB2TNWLix/4Z.pmg
1689205173.981163	CdRhWT3WJiNJd6yI4d	10.7.12.121	50522	151.248.117.244	80	GET	/uploaded/A_2F4A2NUe5_2FbcLw/y9g3yPNe8/I5F7Dpf6Yg0j8yQsIl_2/FHYzmvWP7IqWgEBI0fW/eqvpIE04twojiYV71OKBHD/l_2BxvI2S4pk_/2FMSSyT2/gXZ9AXpjgKZol4xOqH78EFw/B2otW_2Bm6/17LdCNZKFf6pu8WAM/_2FTXM6iBwS8/F5lw7rv_2Bn/jwAr_2Bsp1P_2B/00mkzvLZHXz124QUpxCUM/XVTRCO_2BQsgT9Of/eRH9sUgWQa0ivyI/CR5blnpk1YFLD_2F_2/BCmDAznSt/RYvT8qOZpXoBECkaVi5g/Ra3Hc4yvRfQG9e1Ycmx/BopV14TvH_2BC4YG_2BfHX/obipDdwJthz5V/_2B.pmg
1689205304.030013	C4LIRIHQPjU6UiSOh	10.7.12.121	50552	151.248.117.244	80	GET	/uploaded/6ouUSLng_2BjHfX/r3RWr7xSHnOwd2safW/tWQVdptRE/2Z_2Ba7XHBhX0yu9TeCZ/hOOVEMTqqAHCAHDuLyL/in03M5Bdxt7WO7nRhZVN3K/PtMc51QGlUM_2/FU4vBYuO/7YvOO7eXErXzvmyQrw8Gjqs/cMIFMoin4e/L8MTgb1_2BHThPaQ7/vw_2FRrWQmJA/JTcRb3gBJrO/CUbjldHlt4BYjx/_2BMC6xAOHJ_2FYbHDWdq/b_2BMjgkNFJHRn0i/Kv0epfsPSVw9xG7/59Q9_2Bd6Kaz2qbiws/MV46AUiS0/TOb_2Bgx8Brh3stfhGsX/Nscxzz6IShtqcxfb6Lb/M1SxClGqw/DD.pmg
1689205364.037481	CQnCV1iF8YjETdeQf	10.7.12.121	50565	151.248.117.244	80	GET	/uploaded/8KsDKA4X4WC/sQigQjPAZ0ukUQ/qxyJPJxgM0q02zeod_2Br/W0GHQORdsH1oPIzR/rHfscBrod_2FXaw/FDpFlgxDJ5UrhHU0M7/TthAca2FJ/v_2BKqt0711Nx14YkbI9/52dqns5FAGDPGLTe8BX/zJhATy1SmvKXA8o2TZQ_2F/0gHLhxwyEkR8e/59gRQ24E/qx1jSlEK_2BaW2RB1vL6PPy/vLsEliJMkU/Jah478ougrYwfQuyU/myd27Y4Srgh9/Q_2FlAiDnEL/Hi_2ByVF6moTwE/KA8YT4LEoFk5sHYslC8i7/WQLliqG5T8i/XwaV0uQN.pmg
1689205424.009413	CWV1P3151cMujgYXRk	10.7.12.121	50577	151.248.117.244	80	GET	/uploaded/xxs91Rdsx1UzWc/S83UlKTHZtAmSrHNhF8gq/6Vt6HIqxaamkyKpC/a2OuQwHZp60r62a/Nu1a_2FfcpOPZ4kzOg/xW7MpCKl7/aPBWfqsrj_2BSAgZSyuS/IPcKYrslnyLoF2ORv3y/0PjohyQw_2FniZrdeA2jsC/AAfCyNNmupVnt/Gjgo8YVE/3nFy3pUjsVRA7DOhbJ7Jt_2/Bp0kRMxVy0/2Ik4iQgKDsTAr8hIw/oAbDdyArF_2F/4ZFHJiaiINA/42aQz8ceIuuecp/7aSbCqorR1Kex_2FEOEZz/gP2iBzqAonxZDw1G/CCEUImipEV_2Bo8/yNJA_2F1tPVGm_2F70/31cVst.pmg
1689205564.057046	CETFoW1N76CJjEjT9d	10.7.12.121	50603	151.248.117.244	80	GET	/uploaded/2aSLHl6vcoZ33Lg3/8bnJhk7qsuEFuBP/mbBeGhx4JT1THRXeUu/FyZQBey5_/2FczurMifsEmQxOSwUwN/mFuZV8Jk6uPKuhr6ijk/tyFJBRG7Hk9qoO_2Fv0mGS/vuTKBaXFcm8ql/n_2BqdE_/2FRL6klFhDGImbTDQBQzaqI/M7O_2BR4AA/kec_2FhwQngzhYefq/nngnEAs6_2Fs/WUW6WKvu738/9bVMN2Lc7qSfrL/QoJX6I4cynkVl1T1yUe9k/83PjOXCscf6NNCPp/MCirAph1LeVnHZV/gYzlRwwaLNdS9OdLRA/gVpGpMjpP/pToPWxSa8Nv_2F2wcqGC/9UxC1BPnc/R.pmg
1689205624.136581	CM4rP44To5Keaj6Xbj	10.7.12.121	50615	151.248.117.244	80	GET	/uploaded/HBG522qNLXOWj3/obTIhMWoftSnASS2ugY1I/A_2BQD4CAIqMWAry/qLrg0ckJHhVl5lO/z0DPVvPFajhmkmGde9/b4NkKKf6f/RjraB5JCdaYd6VhZd0Gz/ziLzFtEU_2BTNRrPJT4/TaSTcU62GKqD5r8ZfKZyqo/uB_2BwNKP_2BM/_2FQjTlB/bSaGjcvPFnEFs73_2FvA9uk/A88zWHRfz4/qERd8caxRqlOeAs0b/HIBTQcSEE9Uy/5n6DHfKvmd2/glW_2FWIir1943/_2F0EL7qx8TXIRs3wwdQa/ECRPtd_2Bz0gyguY/AmDPlCLcRd3Mti6/LKgtVjb0CJZ_2F99Xt/ImaHIe6z.pmg
1689205684.143274	CC0oNM20B5fEE2iDJd	10.7.12.121	50634	151.248.117.244	80	GET	/uploaded/yRy5PyjPN/U0zMykzdEJSvA_2BRmC_/2Bzg3hHuyMt6eyabJLf/C5_2BDY7ct42lMLi02_2FB/Iz5_2BFIErbKg/3CcIP3j_/2BBRLHCYS8YJwz0CBEckdjA/DG2abT4LcD/eZUpaBNsOvuaznubV/F9T0RODlAxf_/2Fvx0dDgO2C/rUBVjhJN7utwJM/7tUbNgUSLuHjE_2FEq_2B/zUw7xMYS2a1T5zqO/SsSvjSmOr_2FZWk/tAcYVwtpLdMCeHbGn_/2F5WATLU_/2FMaXAaiz2PPWxN_2FS8/bAyS559ILeNgCcVfOyH/8AXWBH6CUEtS5rE18NI25Z/vivpxhf.pmg
1689205694.620118	CC0oNM20B5fEE2iDJd	10.7.12.121	50634	151.248.117.244	80	POST	/uploaded/gcJDr2AI1Y0w_2BjL5P/s4Pc7LkJzJj5PKFxpKKqDD/IIMw4HfnW_2BC/v_2BuOCf/W_2BYNju_2F6BihPzKk4a7G/V0tdFDnDY_/2FdZIM9qzuzOhv10b/85PwLuTyxfU4/cnD1A_2Fg_2/Ftz_2Fr_2FS4yU/Dzb60oPBOlknzPO3UuvMS/R_2BW_2B_2BNTTFF/I1cd7iultIz0y5o/mGFY1qpTr0yoLbfJK7/ekxrivpPn/z6aOORSe9GopcDlOnPp_/2FpfVDxzFnrveXtl4H1/uK4ZpUbz4L2KFNb3S_2FDQ/Gw8uzk_2BY3nH/JeqoR3lv/Ol1eSAzwKH28F3/E_2FvP6z/L.dib
1689205884.190025	C8OTyM3QLLANhzAhS1	10.7.12.121	50678	151.248.117.244	80	POST	/uploaded/_2FmaeD8ZP/ifvs3LAiNUyyHcyI5/2zizGfYadXM7/zn1MkfzxDz4/GcIyjTDPIH3xZt/f2iwz_2BZHZbe1_2BNeqx/OElSsmV7SVKYgQnH/cd5D4blI0VPfdKM/h5Eqbou2vto6DloSMC/AMVp2H154/ykAXRHPchanas17xPPCy/GUPYtR2LfYtrcU7YKZl/IItqeXkpPu6utOdait7qam/WvCYugUrAvmKm/W9BtO8nd/ox2rfAPkkCNbw3EPQqDf4AF/7WS3RJRlqf/igarL9XSNsEw5QOMO/BWCprkV9/b.dib
1689205885.173395	CZKmJe3BZnVOLOScJg	10.7.12.121	50680	151.248.117.244	80	GET	/uploaded/_2BnUohG_2B5_2B_2Fm/Tk56Ts0q5WP_2FoNHTOdmD/rdlq_2BSwXJtb/uEFGGVyS/v02AOf7m2A91skcD_2FghaD/fRIE3CBBJN/usKyamTlJJKzLbv7r/HjjGQZYvbgo_/2BG_2BXIYSx/_2FXNVJZRpn15m/XxvhWhedCEPVUVmKdDwJO/5ucDCzhqkC5a_2FR/E2UNf6mowh2qlvC/jmGHygtC7KiiNZkqaj/r_2BursuK/gtBlM_2FoSTRZeF_2BEq/zOuZvJzgGUPItGtWIU0/8k0rNZJZshLHBu7TTMTzA7/6SFKvDlV9Tm_2/BXBA3Wbw/_2F7UxxX_2F7xiz_2FkojUT/simrDZhYK_/2FP7XAeJ/2583o5l.pmg
1689205895.813572	CZKmJe3BZnVOLOScJg	10.7.12.121	50680	151.248.117.244	80	POST	/uploaded/A3DnK0nojv/2_2BhD11XTyIQqVRn/8jUJ0RiH8yiw/yahXfipN8a2/x9RzjlgF83SjYy/0JDc9sqMDYsIAaOfuCovs/Ty0ofuck4bh2dKjm/hq1xSpmNk6oh2ML/x3N8CpWU6CLhSHnq6g/jfS57w9hg/JEQvMlDZxvZgL4171LiW/UNBw8_2F9Qut0Uyk1o0/jHTpN2gK2WkJ5ayEyiGCQU/f3mOViCWjruTN/py5A5_2F/qJjLlT0UcOtx0kd1q_2B_2B/lxWUdfqcwF/X1OZJJqh3tKkv3uin/z3azx2n2_2FQ/7f5JPz2Rdrj/KbU4pBSt_/2FU0Bb.dib
1689205945.179329	CvTDqyv0AzFZYhvYa	10.7.12.121	50695	151.248.117.244	80	GET	/uploaded/FhUVI0FXlc_2BoMn06gF729/PZltHMmQKJ/5gXAV6qrrG3uVZUkQ/Xz7x6_2BCuoi/vGyaUgAygI7/o0ZOyNAoVPjezt/qrYPomx0I20uTpc71AhKH/hmoc0Se6MlNDQFPJ/_2F3XxhEhBwTTt8/dzR0Rhd5_2Fg_2BfQm/vZ5yiRBi1/o83BXce_2F5B1qqHD2Ry/R0Wp_2B5Ob2UzvhptgS/ArYJX9LdMN7PLlZYncKkKC/MexLEH3W0S1LD/vPG8R3Kh/P_2BSM2c5Ds7PKp68CbLQPa/uRcc1_2BWU/O1LVc95SxfhdeipD2/Meh5LyKfgfvP/mw7bBh60WDx/BEAYNoQki2err_2FD3/J.pmg
1689205955.653485	CvTDqyv0AzFZYhvYa	10.7.12.121	50695	151.248.117.244	80	POST	/uploaded/uHvVwv8ztSf/YE8iS_2Fn7FZfi/1bmr0x17mB6C40Jyyv57w/IB95LyOQHJuhjDHB/8eA5PydslLzSsfM/p_2F1v6TecaZ3wGx6d/E_2BD_2Fy/lxEDrRoN1_2FCgTsGmDZ/YFfl9rkH3zn1QidHoVO/FRyiev96T_2Fr_2B2JECpx/lMNqqhysM_2Fg/8FJlj084/rVQj3XWYixWQEB51XT650ZH/h7DSfpl4_2/FB9JYyPG7aHe9s0Ej/e5N1XyK6sQDr/Xh_2BBix8xL/FxGO9c3b4Gmmyi/Akwj6_2FqRbJ9zSU_2BMG/AFhU7OtAPVYWmIpn/27S9nDIQ/GkX6a.dib
1689206075.315802	CGaqMT2Bkznty4vuRj	10.7.12.121	50720	151.248.117.244	80	GET	/uploaded/Xr_2BPv5nEcYdv_2Fgf/lvqqDleE4MRR61NVNECACj/2b6nG5NNQpbf7/IOyJ3mOC/S0vksV6Cdjp0lObgW5yKE00/CiKBa9b2yF/SdPufFs01SP0hGmHE/Tx_2FAfjG_2B/dUcDi0fycTW/6_2BVoOGIPCxif/QBrp6_2FgZKYbPlMlVITD/dkKeYxISGP0exkFt/k_2BhKlYIA9TIIi/IFKg0DKYPafD974SOa/3VOwHRGON/iQ3g358ev2Y_2BBa7EHG/0ZoCnGCbCMbhJ7awWRm/kfhaPTx_2B9Ojsabyah6zf/1xMo393JbANP6/0UPfFKIn/QcODCPR0hHlk75v_2FNZ6CO/jnoW4Ci.pmg
1689206135.322455	CeJaoEsgZUUehqGXf	10.7.12.121	50732	151.248.117.244	80	GET	/uploaded/9E9qDlZVJvqNnGW7TShFuT/1biZ_2Fi7HMon/tkM1eH_2/BF8Lieu7FjNnM5_2BtQ_2BF/KctIwVoRoq/s4DBx4KERmnBVV4j9/fnZCM3mgkZZR/yAX6RmKQ4NF/7KM81nayQDbgjC/kk747StwWTHLo6ryma0Eq/9bDlaNn3mltZ43_2/Ba67gibV_2FA_2B/fzcA9QIWxtylaJyMCG/0hnTBEsk9/kx1h2tT9EE5_2FASkS7x/LO_2FdqMhOS0HYQP0n7/ikEky43_2By6XFJ6EpGt8S/6myX6v24xI_2B/dttaDzab/5BuGblW17GnmmFL8vWfVhy3/SM1zErTpHP/QNCwD0f6F/a_2Bjm7IV3/D.pmg
1689206195.319905	CxCf8J2esw472Ielw	10.7.12.121	50744	151.248.117.244	80	GET	/uploaded/MxwfHjb_/2Fsi1R4cG_2BLBzNNwpkth7/_2BkeQTnyp/JdOs1LM1ta2RGNjKc/FJmgdMzxP6TL/R878kL_2BJ6/MrNHaWZ7pqsl1o/Kv6bDne5oy28T_2Fsphc3/Mbzro3ezkEOY8HwS/yoy5hSqLt2GMurW/4XloBbMRRWynowB_2F/G3P7XPMpG/6gPurGeov4oduybTlHju/sBsgmp6tFQsT5_2BFwq/pGKkMPDpFpegL9t5Gqqp0d/r7H2HrRg5cgOr/YJj0PxHJ/Y_2FlJWBZiI7OQWPlkxv6u8/u3AP5vidjW/PvyHK2bHR5WijgWRn/f5RP_2BuZnur/K9G9NXBUw14B7uQuD8l/K.pmg
1689206325.368641	Cln6984XP6WQL2a6jh	10.7.12.121	50771	151.248.117.244	80	GET	/uploaded/S4HyeK9TGfwVytknkf5j2X/9VKi2aqUv0tUN/J7Pi7aBd/uUtyY5PrSswVetuJrmLbQOb/yXyhfb00bF/tL1cR2OD9sBho_2Fg/vmYH3f6pvbqX/pblAvign4Da/ziCSk2vRD_2B2K/x93lcVy0T1rbeYLe4K4uR/t7BMciRKPQlcn1zp/UQ_2BWly9W2o1s5/_2FwrRhOdKUHuJtcjG/Lc3o_2Fhk/kBc_2BZp6xV_2BE9Djgf/a_2Fsd22O_2FZeW_2F2/mCdSgfLJHfcjHwflf7Q_2F/LeVls1JFsgfYz/5dQagn16/Kjgg0Lc3NKt1_2B2I1H2zOt/uRKccbXKP_/2FA8MBDpb0G23EXY81Tyx/h.pmg
1689206385.316670	CALuC816KX0SuRA93k	10.7.12.121	50783	151.248.117.244	80	GET	/uploaded/VcSCrD_2F_2/BKyBAIxpStofT6/txC4Pni9EG_2BFbKqUx_2/Fw9s4Zg2fwdtvoMJ/Fr6UyR1uP9PRBN1/FQZ6hz6Mb_2Fs_2F49/_2BkvjXF7/w8MfT_2B32RaOM5ijT_2/BzGKFuqMa5OzlLI_2BT/A_2FGOoDi_2FP_2F8zb2Yr/pIb51vNHV25_2/BGIXUCRW/oMLsPVA84EAhSj9fCXt0ilY/Cxf2YThLeu/NIEKMHtLXO5SEVrsR/EHwwPqidwENp/fDqtP7kFnSX/5o3VYS7mpe5E1c/x6KP6J7oE0yDXxAJaeyUe/6JuH70X_2Fjs56xO/bGXUaoK1Jmw6y_2/FvqA1eXlmviDm7Rk39/4JHyQ0dF/t.pmg
#close	2023-07-24-19-00-14

notice.log Example:

#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	notice
#open	2023-07-24-19-00-13
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	fuid	file_mime_type	file_desc	proto	note	msg	sub	src	dst	p	n	peer_descr	actions	email_dest	suppress_for	remote_location.country_code	remote_location.region	remote_location.city	remote_location.latitude	remote_location.longitude
#types	time	string	addr	port	addr	port	string	string	string	enum	enum	string	string	addr	addr	port	count	string	set[enum]	set[string]	interval	string	string	string	double	double
1689201023.169002	ClEkJM2Vm5giqnMf4h	10.7.12.121	49799	151.248.117.244	80	-	-	-	tcp	GoziMalwareDetector::GoziActivity	Potential Gozi banking malware activity between source 10.7.12.121 and dest 151.248.117.244 with method GET and URI /uploaded/8jvrTb2D/c4CxLmogLgZQGC_2FQ_2B2b/Ma3ylmhq8i/MeT_2Fmtq1zDpHZZQ/2OknTIetuvPf/SqlzkcwbzWM/aFx0b70stnXODu/WDQ2wUhiUaYRbirzPbAvc/2V_2Feb1BeDPQaU0/WZs_2FbMUKJ37c4/Gf5YYgB_2B8BS7mcYa/jECotoj7R/7bH1bkdIXbwbqpU0Nryv/_2BfEwnTZ0On333QjdJ/fdFWYGQpQofXObilmWG0P_/2BS5YP7Tcj18X/cQoSxxb6/FYqDyT3sva2N6amcI32HXsv/n6pffb_2FO/UxvFILD91uIk2oNQx/DEmgyRV_2FLi/3pF67pmCpVP/mFnn0G63A1Sv9N/05KeIqFG3zHYuPPOU/1P.pct	-	10.7.12.121	151.248.117.244	80	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1689201032.792223	CtPZjS20MLrsMUOJi2	10.7.12.121	49801	91.199.147.95	80	-	-	-	tcp	GoziMalwareDetector::GoziActivity	Potential Gozi banking malware activity between source 10.7.12.121 and dest 91.199.147.95 with method GET and URI /vnc32.rar	-	10.7.12.121	91.199.147.95	80	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1689204683.938169	CilF4d1b6woayAE906	10.7.12.121	50413	151.248.117.244	80	-	-	-	tcp	GoziMalwareDetector::GoziActivity	Potential Gozi banking malware activity between source 10.7.12.121 and dest 151.248.117.244 with method GET and URI /uploaded/bc1bm932Gi8AkB7CMdoi/dV6NGeXlcWdoFbsJnFC/FQZnIx7u0wQZs8gXewgk2O/_2BqEL_2F5vUH/VjpcgRrm/NgFQBF4d0ml2qUjPnz05CNh/WBeUsAyX8h/DYU_2Be6ioc_2FA9o/bkBn4zKxTE1N/1SebIT_2BB2/5hdp86s2tIvCxD/tZmUgcI6tODvZKdoJyys1/e4sK8m7GZS45MABe/ErGNCS3Es2MiUbX/8g2aKSm8DCj6uNwDbP/RnZ8rlx9a/lrUNLg4HRLMm6ysR4pwf/VtZBd5aLMF2Q_2FrqZr/qT7tLbEkySOgW4gIG9cEFr/b3tW5AqoOLBZY/_2FK4oG1/WJk_2B.pmg	-	10.7.12.121	151.248.117.244	80	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
#close	2023-07-24-19-00-14

zeek-gozi-detector

Gozi Malware Detector

Resources:

PCAPs

Example Logs:

gozi.log Example:

notice.log Example:

Package Version :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :

Description :

Script Dir :

Test Command :

Depends :